CVE-2026-77161: Smart Marketing SMS Plugin SQL Injection

CVE-2026-77161 Overview

CVE-2026-77161 is a SQL injection vulnerability in the Smart Marketing SMS and Newsletters Forms plugin for WordPress. The flaw affects all versions up to and including 5.1.24. It stems from insufficient escaping of a user-supplied parameter name combined with a lack of query preparation on an existing SQL statement. Authenticated attackers holding subscriber-level access or higher can append additional SQL queries to extract sensitive data from the database. Exploitation requires the plugin's sync feature to be enabled via options['enabled'] and get_option('egoi_mapping') to return a truthy value. Both conditions reflect standard configured states for the plugin's core contact mapping functionality.

Critical Impact
Authenticated users with subscriber privileges can extract sensitive database contents, including credentials and user records, through injected SQL statements.

Affected Products

Smart Marketing SMS and Newsletters Forms plugin for WordPress
All versions up to and including 5.1.24
Installations with the plugin's sync feature enabled and egoi_mapping configured

Discovery Timeline

2026-09-12 - CVE-2026-77161 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-77161

Vulnerability Analysis

The vulnerability is a generic SQL injection classified under [CWE-89]. The plugin builds SQL queries using a parameter name provided by the request without escaping or parameterization. Because the injected content becomes part of the query structure rather than a bound value, standard prepared-statement protections are bypassed. Attackers append UNION-style or stacked expressions to the existing query to read arbitrary data. Successful exploitation requires only subscriber-level authentication, which many WordPress sites grant through open registration. Vulnerable code paths reside in admin/class-egoi-for-wp-listener.php and includes/class-egoi-for-wp.php in the plugin trunk, per the WordPress Plugin Code References.

Root Cause

The plugin passes a request-controlled parameter name directly into a SQL statement without sanitization or $wpdb->prepare() handling. WordPress's database abstraction cannot bind identifiers such as column or parameter names, so developers must whitelist or escape them explicitly. That validation is missing in the affected functions.

Attack Vector

An authenticated attacker sends a crafted HTTP request to the plugin endpoint that consumes the vulnerable parameter. The malicious parameter name carries SQL fragments that the plugin concatenates into the query. Exploitation is possible only when the sync feature is active and get_option('egoi_mapping') returns data, which are default states after normal plugin configuration. Refer to the Wordfence Vulnerability Report for the disclosure summary.

// No verified proof-of-concept code is published for CVE-2026-77161.
// See vendor and Wordfence references for technical details.

Detection Methods for CVE-2026-77161

Indicators of Compromise

HTTP POST or GET requests to Smart Marketing plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA inside parameter names.
Web server logs showing unusually long or URL-encoded parameter names targeting class-egoi-for-wp-listener.php handlers.
Database error entries in PHP or WordPress logs referencing malformed queries from the plugin.

Detection Strategies

Inspect WordPress access logs for authenticated requests from subscriber accounts hitting plugin AJAX or admin-post handlers with anomalous payloads.
Deploy web application firewall rules that flag SQL syntax appearing in parameter names, not just parameter values.
Correlate new subscriber account registrations with subsequent requests to plugin endpoints to identify low-privilege exploitation attempts.

Monitoring Recommendations

Enable MySQL general query logging temporarily on affected hosts to capture injected fragments.
Alert on wp_users and wp_options table reads originating from plugin execution contexts.
Track outbound data volume from PHP workers running the plugin to detect bulk extraction.

How to Mitigate CVE-2026-77161

Immediate Actions Required

Update the Smart Marketing SMS and Newsletters Forms plugin to a version later than 5.1.24 as soon as the vendor publishes a fix.
Restrict user registration or disable subscriber-level self-signup until patching is confirmed.
Audit existing subscriber accounts and remove unrecognized users.

Patch Information

Review the WordPress Plugin Change Log for the code changes associated with revision 3663923. Verify that the deployed plugin version incorporates parameter-name whitelisting and query preparation before restoring standard user access policies.

Workarounds

Disable the plugin's sync feature by unsetting options['enabled'] until the patch is applied.
Clear or invalidate get_option('egoi_mapping') to break the exploitation precondition where the sync workflow is not required.
Deploy a WAF rule blocking requests that place SQL metacharacters inside HTTP parameter names.

bash

# Example WAF rule concept (ModSecurity syntax)
SecRule ARGS_NAMES "@rx (?i)(union|select|sleep|information_schema)" \
    "id:1077161,phase:2,deny,status:403,msg:'CVE-2026-77161 SQLi attempt in parameter name'"