CVE-2026-81756: WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability
Published Aug 31, 2026
·Updated
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
Affected Software
1 affected component
WordPress Smart Marketing SMS and Newsletters Forms<=5.1.24
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Smart Marketing SMS and Newsletters Forms pluginto a version that resolves this vulnerability.Fixed in 5.1.25
Event History
Aug 31, 2026
CVE Published
via MITRE·08:30 PM
Data Sourced
via MITRE·08:30 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. The network attack vector indicates it can be targeted remotely.
2
Which installations are affected?
WordPress sites using Smart Marketing SMS and Newsletters Forms version 5.1.24 or earlier are affected.
3
What security impact does successful exploitation have?
The supplied severity vector indicates high confidentiality impact and low availability impact. It also indicates scope may change, while integrity impact is listed as none.