CVE-2026-77161

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled (options['enabled']) and get_option('egoi_mapping') to be truthy, both of which reflect ordinary configured states for the plugin's core contact mapping functionality.

• CWE-89

• https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/admin/class-egoi-for-wp-listener.php#L132
• https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/admin/class-egoi-for-wp-listener.php#L183
• https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/includes/class-egoi-for-wp.php#L841
• https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/includes/class-egoi-for-wp.php#L908
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3663923%40smart-marketing-for-wp&new=3663923%40smart-marketing-for-wp
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f14e3f20-b022-49f8-89b0-acca9b950cb8?source=cve

Published

Sep 12, 2026

Last Modified

Sep 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77148A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This i…9.9
• CVE-2026-7715A vulnerability has been found in ravenwits mcp-server-arang…6.3
• CVE-2026-77150The Unlimited Elements For Elementor plugin for WordPress is…6.1
• CVE-2026-77151A security flaw has been discovered in lin-snow Ech0 up to 5…3.7
• CVE-2026-77159A symlink-following flaw was found in libvirt's qemuTPMEmula…5.5
• CVE-2026-7716A vulnerability was found in code-projects Gym Management Sy…6.3
• CVE-2026-7717A vulnerability was determined in Totolink WA300 5.2cu.7112_…8.8
• CVE-2026-77176A flaw was found in Kata Containers. In configurations utili…8.1
• CVE-2026-77179On macOS, the virtio-fs host server used by Docker Sandboxes…9.4
• CVE-2026-7718A vulnerability was identified in Totolink WA300 5.2cu.7112_…6.3
• CVE-2026-77180When NGINX Ingress Controller is configured with Ingress ann…8.3
• CVE-2026-77181Incorrect Authorization vulnerability in Apache Syncope. …9.8