SQL Injection Vulnerability in Smart Marketing SMS and Newsletters Forms Plugin for WordPress

CVE-2026-77161

What is CVE-2026-77161?

The Smart Marketing SMS and Newsletters Forms plugin for WordPress presents a SQL injection vulnerability due to insufficient escaping of user-supplied parameters in its SQL queries. This weakness allows authenticated users, with subscriber-level privileges or higher, to inject additional SQL commands, which can lead to unauthorized access to sensitive database information. Successful exploitation requires the plugin's sync feature to be activated and certain configuration states met, enabling attackers to leverage commonly used functionalities inappropriately.

References