Executive brief
The Smart Marketing SMS and Newsletters Forms WordPress plugin contains a SQL injection vulnerability that allows authenticated users to extract sensitive data from the site's database. An attacker with subscriber-level access can modify parameters to inject malicious SQL commands when the plugin's sync feature is enabled, potentially exposing customer information, email addresses, and other stored database records.
Technical details
The vulnerability is a generic SQL injection (SQLi) flaw resulting from insufficient escaping of user-supplied parameters and lack of proper SQL query preparation. The vulnerability resides in the plugin's sync feature and is triggered when both the sync feature and contact mapping functionality are enabled (options['enabled'] = true and get_option('egoi_mapping') is truthy). Exploitation requires subscriber-level or higher authentication; the attacker can append arbitrary SQL commands to existing queries via manipulated parameter names to extract or modify database contents. The flaw affects all versions up to and including 5.1.24. A patch is required to properly escape parameters and use prepared statements.
Affected products
- Smart Marketing Smart Marketing SMS and Newsletters Forms up to and including 5.1.24
Timeline
- 2026-09-12: disclosed