EUVD-2026-68784
GHSA-m3fp-q996-3vr3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin
-
DeliverySend crafted request to form endpoint
-
ExploitInject SQL via unsanitized parameter
-
ExecutionExecute attacker-controlled query
-
ImpactExfiltrate database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that a vulnerable version (<= 5.1.24) of the E-goi Smart Marketing SMS and Newsletters Forms plugin be installed and active on an internet-reachable WordPress site, with the vulnerable form/subscription endpoint accessible. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), there are no special conditions - remote unauthenticated exploitation is possible against default configurations where the plugin is enabled. The primary limiting factor is deployment scope: the target must actually run this specific plugin at an affected version; the exact injectable parameter/endpoint is not detailed in the provided data. |
| Impact | The risk signals point to a genuinely serious, easily reachable issue rather than a paper-high CVSS: the vector is fully remote and unauthenticated with low attack complexity and no user interaction (AV:N/AC:L/PR:N/UI:N), and confidentiality impact is High, which is the classic profile of an exploitable data-exfiltration SQLi. That said, several signals are absent: there is no EPSS probability provided, no CISA KEV listing, and no evidence of public exploit code, so active exploitation cannot be asserted. Note also a tension worth verifying: the NVD-style vector records I:N and only A:L despite SQLi commonly enabling data modification, so the impact metrics may understate write/integrity potential - verify against the Patchstack advisory. Because exploitation needs no authentication and the affected product is a public-facing WordPress plugin, any operator running an affected version should treat patching as high priority even though the plugin's overall install footprint is modest. |
| Exploit ScenarioDerived | An attacker locates a WordPress site running Smart Marketing SMS and Newsletters Forms 5.1.24 or earlier and sends a crafted request to a plugin form or AJAX handler with a malicious SQL payload in a parameter. Because no authentication is required, the injected query executes against the WordPress database, allowing extraction of sensitive data such as user records and password hashes. No public proof-of-concept is identified at time of analysis, but the low-complexity unauthenticated vector makes exploitation straightforward once a payload is developed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 31, 2026
SQL injection in the E-goi 'Smart Marketing SMS and Newsletters Forms' WordPress plugin (versions 5.1.24 and earlier) lets unauthenticated remote attackers inject arbitrary SQL through a plugin input, per a Patchstack advisory. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact and a changed scope, meaning the site database can be read without credentials. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
RemediationAI
Upgrade the plugin to a version newer than 5.1.24; the advisory indicates 5.1.24 is the last vulnerable release, but no fixed version number is stated in the provided data, so confirm the exact patched release on the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/smart-marketing-for-wp/vulnerability/wordpress-smart-marketing-sms-and-newsletters-forms-plugin-5-1-24-sql-injection-vulnerability?_s_id=cve) or the WordPress.org plugin page before deploying. If an updated release is not yet available, the safest compensating control is to deactivate and remove the plugin until a fix ships (side effect: SMS/newsletter subscription forms stop working). As an interim mitigation, place a WAF rule (e.g., Patchstack, Wordfence, or modsecurity CRS SQLi rules) in front of the site to filter SQL metacharacters on the plugin's form/AJAX endpoints, and restrict access to those endpoints where feasible - noting WAF rules can be bypassed and may cause false positives on legitimate form submissions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin published by E-goi (CPE vendor 'autorius_e-goi', product 'smart_marketing_sms_and_newsletters_forms'), which adds SMS and newsletter subscription forms to WordPress sites. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-supplied input reaches a database query without adequate parameterization or sanitization. In WordPress plugins this class of flaw typically arises when form/AJAX parameters are concatenated into $wpdb queries instead of using prepared statements, allowing attacker-controlled SQL fragments to alter query logic.
Know when Smart Marketing Sms And Newsletters Forms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated remote SQLi with low complexity (AV:N/AC:L/PR:N/UI:N) enabling full DB read (C:H) and limited write via injection (I:L); scope kept Unchanged absent evidence of cross-component impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
Executive ViewAI
The E-goi Smart Marketing SMS and Newsletters Forms WordPress plugin (versions 5.1.24 and earlier) contains a critical unauthenticated SQL injection vulnerability that exposes the site database to remote attackers without requiring credentials. Organizations using this plugin risk unauthorized data extraction of customer records, email lists, form submissions, and other database contents. No vendor patch is currently available, requiring immediate removal or containment to prevent data breach.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable and remove the plugin immediately; (2) Deploy Web Application Firewall rules to block SQL injection patterns targeting the plugin's input fields; (3) Restrict database user privileges to least-necessary access and enable database access logging for forensic review; (4) Temporarily restrict form access to authenticated users if complete removal is not feasible; (5) Conduct database forensics to identify indicators of unauthorized access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB