SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery Security & Risk Analysis

The 'sms-alert' plugin v3.9.2 exhibits a mixed security posture. While it demonstrates good practices in several areas, such as a high percentage of properly escaped output and a substantial number of SQL queries using prepared statements, significant concerns remain. The static analysis reveals a large attack surface, with a notable 19 out of 34 entry points lacking proper authentication checks. This, combined with 7 high-severity taint flows, indicates a substantial risk of unauthorized actions or data compromise.

The vulnerability history of the plugin is concerning, with 12 known CVEs, including one critical and five high-severity vulnerabilities. The prevalence of common vulnerability types like missing authorization, authentication bypass, SQL injection, CSRF, and XSS, along with the recent discovery of a critical vulnerability in late 2025, suggests recurring security weaknesses in the plugin's development lifecycle. Although no currently unpatched vulnerabilities are listed, the past patterns and static analysis findings suggest a need for significant improvement in secure coding practices, particularly regarding input validation and authorization checks.

In conclusion, while the plugin has strengths in its handling of output and prepared SQL statements, the numerous unprotected entry points, high-severity taint flows, and a history of critical and high-severity vulnerabilities paint a picture of a plugin that requires urgent attention to its security. The risk is elevated due to the combination of exploitable code and a history of severe past flaws.