CVE-2026-77161 in Smart Marketing SMS and Newsletters Forms Plugin
Summary
by MITRE • 09/12/2026
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled (options['enabled']) and get_option('egoi_mapping') to be truthy, both of which reflect ordinary configured states for the plugin's core contact mapping functionality.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in the Smart Marketing SMS and Newsletters Forms plugin for WordPress represents a critical security flaw classified as SQL Injection via Parameter Name, aligning with CWE-89 within the Common Weakness Enumeration framework. This specific type of injection occurs because the application fails to properly sanitize or validate user-supplied input before incorporating it into database queries. The root cause lies in insufficient escaping mechanisms and a lack of prepared statements for existing SQL operations. In standard secure coding practices, parameterized queries should be used to separate code from data, thereby preventing malicious inputs from altering the logic of the query. Instead, this plugin constructs SQL commands using direct concatenation or interpolation of user-controlled variables without adequate validation, creating an avenue for attackers to manipulate database interactions.
The operational impact of this vulnerability is severe, as it allows authenticated attackers with subscriber-level access and above to extract sensitive information directly from the WordPress database. While requiring authentication might seem like a mitigating factor, the low privilege level required—subscriber or higher—is easily attainable by any registered user on most public-facing WordPress sites. This significantly lowers the barrier for exploitation compared to vulnerabilities that require administrator privileges. The attacker can append additional SQL queries to existing ones, potentially leading to unauthorized access to usernames, hashed passwords, email addresses, and other personally identifiable information stored in the database. Such data exfiltration can facilitate further attacks, including credential stuffing or phishing campaigns against affected users.
Exploitation of this flaw is contingent upon specific configuration states within the plugin, specifically that the sync feature must be enabled via options['enabled'] being true and get_option('egoi_mapping') returning a truthy value. These conditions reflect ordinary configured states for the plugin's core contact mapping functionality with E-goi services. Consequently, the majority of installations where this integration is active are susceptible to exploitation without requiring unusual or obscure configurations. This prevalence increases the risk profile significantly, as automated scanning tools can easily identify and target vulnerable instances that meet these common criteria. The requirement for specific options being truthy does not provide meaningful security isolation since these settings represent default operational modes rather than edge cases.
From a tactical perspective, this vulnerability aligns with ATT&CK techniques related to Database Credential Dumping and Data from Information Repositories. Attackers leveraging this flaw can systematically query database tables to harvest credentials or other valuable data assets. The ability to append queries suggests potential for blind SQL injection scenarios where the attacker infers information based on application responses rather than direct output, further complicating detection by standard web application firewalls that may not inspect parameter names deeply enough.
To mitigate this vulnerability, immediate action is required from both plugin developers and site administrators. Developers must implement strict input validation and use prepared statements with bound parameters for all database interactions involving user-supplied data. This ensures that any special characters in the input are treated as literal values rather than executable SQL code. Additionally, implementing least privilege principles for database connections can limit the damage if an injection does occur by restricting the permissions of the database user account used by the application.
Site administrators should update the Smart Marketing SMS and Newsletters Forms plugin to version 5.1.25 or later as soon as possible. If updating is not immediately feasible, disabling the sync feature and ensuring that egoi_mapping options are unset can temporarily reduce the attack surface until a patch is applied. Regular security audits and penetration testing should be conducted on WordPress installations to identify similar weaknesses in other plugins. Monitoring database logs for anomalous query patterns can also aid in early detection of exploitation attempts. Maintaining up-to-date software components remains the most effective defense against such injection vulnerabilities, as developers continuously address these issues through rigorous code review processes and adherence to secure coding standards like OWASP Top Ten guidelines.