CVE-2026-77161
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on user-supplied parameters and lack of sufficient preparation on the existing SQL query. An authenticated attacker with subscriber-level access or above can append additional SQL queries into existing queries to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled and the egoi_mapping option to be truthy.
Risk Assessment
An attacker with a subscriber account can read sensitive data from the WordPress database, including other users' data and site configuration. This represents a serious confidentiality breach.
Recommendation
Update the plugin to a version newer than 5.1.24 as soon as it becomes available, and in the meantime consider disabling the sync feature or restricting subscriber access.
Other vulnerabilities in Smart Marketing SMS and Newsletters Forms
Original NVD description (English source)
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled (options['enabled']) and get_option('egoi_mapping') to be truthy, both of which reflect ordinary configured states for the plugin's core contact mapping functionality.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS