CVE-2026-81756

CriticalCVSS 9.3

Published: 31/08/2026(UTC)Updated: 02/09/2026(UTC)Translated: 01/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

An unauthenticated SQL Injection vulnerability was detected in Smart Marketing SMS and Newsletters Forms versions up to 5.1.24. This vulnerability may allow an attacker to manipulate database queries.

Risk Assessment

An attacker can gain unauthorized access to data in the database, modify or delete it, potentially leading to data confidentiality and integrity breaches.

Recommendation

Update Smart Marketing SMS and Newsletters Forms to the latest patched version. Additionally, use parameterized queries and restrict database privileges.

Other vulnerabilities in Smart Marketing SMS and Newsletters Forms

CVE-2026-77161Medium
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on user-supplied parameters and lack of sufficient preparation on the existing SQL query. An authenticated attacker with subscriber-level access or above can append additional SQL queries into existing queries to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled and the egoi_mapping option to be truthy.

Original NVD description (English source)

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS