Description
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled (options['enabled']) and get_option('egoi_mapping') to be truthy, both of which reflect ordinary configured states for the plugin's core contact mapping functionality.
Published: 2026-09-12
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data Exposure via SQL Injection
Action: Patch
AI Analysis

Impact

The Smart Marketing SMS and Newsletters Forms plugin for WordPress contains a classic SQL Injection flaw (CWE-89) that allows authenticated users with subscriber-level or higher privileges to craft specially named parameters that inject additional SQL statements into existing database queries. This unescaped injection can be used to extract arbitrary data from the site's database, leading to confidential data exposure.

Affected Systems

All releases of the egoi Smart Marketing SMS and Newsletters Forms plugin with a version number of 5.1.24 or lower are impacted. The flaw is active only when the['enabled'] is true) and the get_option('egoi_mapping') value is truthy,.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% shows a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker would need authenticated access with at least subscriber-level privileges and the sync feature enabled to inject and execute additional SQL queries, making the practical risk limited by the specific configuration and authentication requirements.

Generated by OpenCVE AI on September 15, 2026 at 18:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Smart Marketing SMS and Newsletters Forms plugin to a version higher than 5.1.24, which eliminates this flaw.
  • If an upgrade cannot be applied immediately, disable the plugin’s sync functionality to remove the vulnerable execution path.
  • Restrict subscriber-level and higher user roles to trusted accounts or to limit the potential attacker pool.

Generated by OpenCVE AI on September 15, 2026 at 18:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 13 Sep 2026 06:30:00 +0000

Type Values Removed Values Added
First Time appeared E-goi
E-goi smart Marketing Sms And Newsletters Forms
Wordpress
Wordpress wordpress
Vendors & Products E-goi
E-goi smart Marketing Sms And Newsletters Forms
Wordpress
Wordpress wordpress

Sat, 12 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Description The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled (options['enabled']) and get_option('egoi_mapping') to be truthy, both of which reflect ordinary configured states for the plugin's core contact mapping functionality.
Title Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

E-goi Smart Marketing Sms And Newsletters Forms
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-14T19:23:01.777Z

Reserved: 2026-08-20T14:49:19.735Z

Link: CVE-2026-77161

cve-icon Vulnrichment

Updated: 2026-09-14T19:15:35.325Z

cve-icon NVD

Status : Deferred

Published: 2026-09-12T08:16:24.103

Modified: 2026-09-14T20:16:52.347

Link: CVE-2026-77161

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T18:45:18Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')