CVE-2026-77161

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled (options['enabled']) and get_option('egoi_mapping') to be truthy, both of which reflect ordinary configured states for the plugin's core contact mapping functionality.

• CWE-89

• https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/admin/class-egoi-for-wp-listener.php#L132
• https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/admin/class-egoi-for-wp-listener.php#L183
• https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/includes/class-egoi-for-wp.php#L841
• https://plugins.trac.wordpress.org/browser/smart-marketing-for-wp/trunk/includes/class-egoi-for-wp.php#L908
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3663923%40smart-marketing-for-wp&new=3663923%40smart-marketing-for-wp
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f14e3f20-b022-49f8-89b0-acca9b950cb8?source=cve

Published

Sep 12, 2026

Last Modified

Sep 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77151A security flaw has been discovered in lin-snow Ech0 up to 5…3.7
• CVE-2026-77152Improper Authorization vulnerability in Drupal Field Collect…5.3
• CVE-2026-77156Incomplete validation of extracted archive entry paths in as…6.4
• CVE-2026-77157ast-cli downloads two helper binaries, the Vorpal ASCA real-…6.4
• CVE-2026-77159A symlink-following flaw was found in libvirt's qemuTPMEmula…5.5
• CVE-2026-7716A vulnerability was found in code-projects Gym Management Sy…6.3
• CVE-2026-77164Circles' remote-instance signature verification fetches the …6.2
• CVE-2026-77165File owners were unable to unlock TYPE_TOKEN locks placed by…6.5
• CVE-2026-77166The emoji field in the page emoji update endpoint does not p…2.4
• CVE-2026-77167Abusing the federated share endpoint, an attacker can write …7.5
• CVE-2026-77169A vulnerability in the team folders (formerly group folders)…6.5
• CVE-2026-7717A vulnerability was determined in Totolink WA300 5.2cu.7112_…8.8