CVE-2026-77161: Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled (options['enabled']) and getoption('egoimapping') to be truthy, both of which reflect ordinary configured states for the plugin's core contact mapping functionality.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Smart Marketing SMS and Newsletters Forms (WordPress plugin)to a version that resolves this vulnerability.Fixed in 5.1.24 - Configuration
Disable the plugin sync feature by setting options['enabled'] to false to prevent exploitation of the SQL injection issue.
Smart Marketing SMS and Newsletters Forms (WordPress plugin) options['enabled'] = false - Configuration
Ensure get_option('egoi_mapping') is not truthy (so it evaluates to false/empty) to prevent exploitation conditions for the SQL injection vulnerability.
Smart Marketing SMS and Newsletters Forms (WordPress plugin) get_option('egoi_mapping') = not truthy
Event History
Frequently Asked Questions
Which sites are exposed in practice?
Sites running an affected version are exposed when the plugin’s sync feature is enabled and the egoi_mapping option has a truthy value. These conditions reflect ordinary configured states for the plugin’s core contact-mapping functionality.
What access does an attacker need?
An attacker needs an authenticated WordPress account with Subscriber-level access or higher. No user interaction is required.
What can be done if updating is not immediately possible?
Disable the plugin’s sync feature to remove one of the required exploitation conditions. Also review whether the configured egoi_mapping value is needed, since exploitation requires that option to be truthy.
How can I determine whether my site may already be vulnerable?
Check whether the plugin version is 5.1.24 or earlier, then verify whether sync is enabled and egoi_mapping is configured with a truthy value. A site meeting all of these conditions should be treated as potentially vulnerable to authenticated Subscriber-or-higher users.