EUVD-2026-76835
GHSA-f69h-9mwp-64rp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain subscriber-level WordPress account
-
ExploitSend crafted HTTP request to plugin listener endpoint
-
ExecutionAppend malicious SQL via unsanitized parameter name
-
ImpactExtract sensitive data from WordPress database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) an authenticated session with at minimum WordPress subscriber-level privileges - fully unauthenticated exploitation is not possible per PR:L in the CVSS vector; (2) the plugin's sync feature must be enabled via options['enabled']; (3) get_option('egoi_mapping') must return a truthy value. The description explicitly notes these two configuration states are ordinary operational conditions for the plugin's core contact-mapping functionality, meaning sites actively using the plugin for its intended purpose are effectively always exposed to authenticated low-privilege users. The impact is read-only database extraction (C:H, I:N, A:N) - the injection cannot directly modify or delete data via this vector. |
| Impact | The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) correctly reflects a network-reachable, low-complexity, low-privilege flaw with high confidentiality impact but no integrity or availability impact. The key limiting factor is PR:L - exploitation requires at minimum a subscriber-level WordPress account, eliminating fully unauthenticated mass exploitation. Additionally, the sync feature (options['enabled']) and egoi_mapping configuration must be active; however, the description characterizes these as ordinary operational states for the plugin, so they are not a meaningful barrier for sites actively using the plugin's contact-mapping functionality. EPSS data is absent from the input. No KEV listing and no public POC are identified, suggesting opportunistic exploitation is not currently occurring. Real-world priority: medium - sites running the plugin for its intended SMS/contact-sync purpose are functionally exposed to any authenticated low-privilege user, making this a realistic data-extraction risk in multi-user WordPress environments (e-commerce, membership sites) where untrusted subscriber accounts exist. |
| Exploit ScenarioDerived | An attacker registers or obtains a subscriber-level account on a WordPress site running the Smart Marketing plugin with contact-sync enabled. By sending a crafted HTTP request to the plugin's listener endpoint with a malicious parameter name, the attacker appends SQL to the existing query and retrieves sensitive database contents - including WordPress user password hashes, email addresses, or other stored data. No public exploit code is known at time of analysis, but the injection path is traced to specific source lines in the plugin repository. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 12, 2026
Authenticated SQL injection in the Smart Marketing SMS and Newsletters Forms WordPress plugin (versions ≤5.1.24) allows subscriber-level users to append arbitrary SQL to existing database queries, extracting sensitive data from the WordPress database. The vulnerability resides in insufficient input escaping on a user-supplied parameter before it reaches an existing SQL query, requiring only a low-privilege account and the plugin's sync/mapping feature to be in its typical operational state. No public exploit or active exploitation has been identified; the fix is available via WordPress SVN changeset 3663923.
RemediationAI
Upstream fix is available via WordPress plugin SVN changeset 3663923 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3663923%40smart-marketing-for-wp&new=3663923%40smart-marketing-for-wp); administrators should update the plugin to the version incorporating this changeset - the exact patched release number is not independently confirmed from available input data, so verify the current version in the WordPress plugin directory. As a compensating control while patching, administrators can disable the plugin's sync feature by setting options['enabled'] to false, which blocks the exploitation prerequisite; however, this disables contact-mapping functionality. Alternatively, restrict WordPress subscriber registration if untrusted user accounts are not required by the site's operation. Enforcing least-privilege role management (removing unneeded subscriber accounts) reduces exposure without affecting plugin functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code is the E-goi 'Smart Marketing SMS and Newsletters Forms' WordPress plugin (CPE: cpe:2.3:a:egoi:smart_marketing_sms_and_newsletters_forms:*:*:*:*:*:*:*:*), which provides contact-sync and SMS marketing integration for WordPress. CWE-89 (SQL Injection) applies: user-controlled parameter values are insufficiently escaped and concatenated into pre-existing SQL queries rather than being passed through prepared statements with parameterized placeholders. The vulnerable code paths are identified in class-egoi-for-wp.php (lines ~841 and ~908) and class-egoi-for-wp-listener.php (lines ~132 and ~183) - the listener handles inbound sync operations where attacker-controlled parameter names flow into query construction. The injection is of the append/stacking class and is read-only per the CVSS vector (C:H, I:N, A:N), meaning it can extract data but not modify it directly via this path.
Know when Smart Marketing Sms And Newsletters Forms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable via HTTP, subscriber auth required (PR:L), sync config is normal operational state so AC:L; read-only extraction so I:N/A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled (options['enabled']) and get_option('egoi_mapping') to be truthy, both of which reflect ordinary configured states for the plugin's core contact mapping functionality.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB