Description

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled (options['enabled']) and get_option('egoi_mapping') to be truthy, both of which reflect ordinary configured states for the plugin's core contact mapping functionality.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-12T08:16:24.103Z",
  "pubdate": "2026-09-12T08:16:24.103Z",
  "executiveSummary": "The Smart Marketing SMS and Newsletters Forms plugin for WordPress is susceptible to a critical SQL Injection (SQLi) vulnerability, identified in versions up to and including 5.1.24.\nThis flaw allows authenticated attackers with subscriber-level privileges or higher to execute arbitrary SQL commands against the underlying database.\nThe vulnerability arises from improper sanitization of user-supplied parameters, enabling malicious actors to bypass security controls and manipulate backend queries.\nThe risk implication is severe, as successful exploitation facilitates unauthorized data extraction, potentially exposing sensitive information stored within the WordPress database.\nExploitation is contingent upon the plugin being configured with the synchronization feature enabled and the 'egoi_mapping' option being set to a truthy value, which are standard configurations for the plugin's core functionality.\nBecause the vulnerability requires only subscriber-level authentication, it presents a significant threat to sites allowing public user registration.",
  "technicalDetails": "The root cause of this vulnerability is the failure to properly escape and sanitize input parameters before incorporating them into SQL query strings within the Smart Marketing SMS and Newsletters Forms plugin codebase.\nThe application relies on direct concatenation of user-provided data into query structures rather than utilizing parameterized queries or prepared statements, which are the industry standard for preventing SQL injection.\nSpecifically, the vulnerability resides in the handling of parameters within the plugin's synchronization logic. When the sync feature is enabled and 'egoi_mapping' is configured, the application processes user-supplied data that is subsequently passed into database queries without sufficient validation.\nAn authenticated attacker can inject malicious SQL fragments into these vulnerable parameters. By manipulating the input, an attacker can terminate the intended SQL query and append arbitrary `UNION` or stacked queries.\nThe attack flow follows a predictable pattern: 1) An attacker authenticates as a subscriber. 2) The attacker intercepts or crafts a request containing a malicious payload crafted to break the syntax of the intended query. 3) The backend receives the input and fails to sanitize the malicious characters. 4) The application executes the concatenated SQL, effectively performing unauthorized database operations.\nPost-exploitation impact includes the ability to query, modify, or delete sensitive data from the database. Since WordPress databases often contain user credentials, metadata, and configuration settings, an attacker can leverage this access to perform data exfiltration or escalate privileges within the WordPress environment.\nAffected versions include all iterations up to 5.1.24. The vulnerability is present in any deployment where the sync functionality is active, making it a widespread concern for administrators using default or standard configurations.\nThe vulnerability does not require sophisticated network access; it is reachable through standard HTTP/HTTPS requests originating from any authenticated user session, including those with minimal privileges."
}