Security Alert Summary
The Smart Marketing SMS and Newsletters Forms plugin for WordPress contains an SQL injection vulnerability that can be abused by authenticated users with subscriber-level access or higher. The issue allows an attacker to append additional SQL queries to existing queries when certain plugin settings are enabled, potentially exposing sensitive data from the site database.
CVE Details
- CVE ID:
CVE-2026-77161 - Affected component: Smart Marketing SMS and Newsletters Forms plugin for WordPress
- Affected versions: All versions up to and including 5.1.24
- Published: September 12, 2026 at 8:16:24 AM UTC
- Last modified: September 12, 2026 at 8:16:24 AM UTC
- CVSS v3.1: Base Score 6.5, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Authentication / privileges / user interaction:
- Privileges Required: LOW (requires an authenticated account; the advisory specifies subscriber-level access and above)
- User Interaction: NONE
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- CWE / weakness ID: CWE-89 (SQL Injection)
Technical Details
The plugin is vulnerable to a generic SQL injection via the parameter name due to insufficient escaping of a user-supplied parameter and lack of sufficient preparation of an existing SQL query. An authenticated attacker with subscriber-level access or higher can append additional SQL statements to queries constructed by the plugin. Successful exploitation enables extraction of sensitive information from the database.
Exploitation requires the plugin sync feature to be enabled (options['enabled']) and get_option('egoi_mapping') to be truthy. Both conditions are described as reflecting ordinary configured states for the plugin’s contact-mapping functionality. The root cause is improper handling of user-supplied input in SQL contexts (absence of adequate escaping or prepared statements).
How This Could Impact Your Website
Consider a small organization where the site owner maintains the site, internal staff use contributor or editor accounts for content, and external contractors submit forms or manage contacts. If the plugin is configured with the sync feature and egoi mapping enabled, a malicious user who has a subscriber-level account or higher could leverage the SQL injection to retrieve sensitive data from the database. Realistic consequences include exposure of internal user email addresses and other stored contact information, which increases the risk of targeted phishing or social engineering against staff and contractors. This exposure does not, based on the provided data, imply full site takeover, but it does raise privacy and confidential data concerns.
professional review If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributor and subscriber accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior related to database queries or unexpected data exports.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/admin/class-egoi-for-wp-listener.php#L132
- https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/admin/class-egoi-for-wp-listener.php#L183
- https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/includes/class-egoi-for-wp.php#L841
- https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/includes/class-egoi-for-wp.php#L908
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3663923%40smart-marketing-for-wp&new=3663923%40smart-marketing-for-wp
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f14e3f20-b022-49f8-89b0-acca9b950cb8?source=cve
