External risk intelligence

Smart Marketing SMS and Newsletters Forms Unauthenticated SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-81756

The vulnerability exists in a WordPress plugin designed for marketing forms and newsletters. Such plugins are commonly deployed on public-facing web servers to interact with site visitors, making them naturally internet-accessible components of a web application.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in a marketing plugin for websites that allows for the injection of malicious code via unauthenticated requests, potentially leading to unauthorized access and modification of data. The primary concern is confirming its relevance and exposure to our systems.

Unauthenticated code injection in marketing forms.
Affects internet-facing marketing plugins.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target the Smart Marketing SMS and Newsletters Forms plugin without needing to log in. By sending specially crafted input to the plugin's forms, an attacker can manipulate database queries. This SQL injection vulnerability could allow an attacker to access sensitive data or disrupt the system's operation.

No authentication required.
Triggered by crafted input to forms.
Risk of data exposure or disruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL code into the Smart Marketing SMS and Newsletters Forms plugin. When the plugin is accessible via the network, this could lead to unauthorized access to or modification of the underlying database.

Sensitive database information could be exposed.
SQL injection via network requests.
Potential for unauthorized data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection vulnerability in Smart Marketing SMS and Newsletters Forms likely impacts public-facing web applications. Responsibility typically falls to the application owner, who should first identify all instances of the affected plugin, confirm its exposure and criticality, and then coordinate with infrastructure or platform teams for remediation during a planned maintenance window.

Application owners should own the issue.
Verify plugin exposure and criticality first.
Plan remediation with infrastructure teams.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Smart Marketing SMS and Newsletters Forms plugin?

This is a WordPress plugin used to manage marketing communications, such as newsletters and lead-capture forms, directly on a website. Because it interacts with site visitors, it typically runs on the web server and connects to the site's database to store and retrieve contact information and form submissions.

What does CVE-2026-81756 mean for my database?

This vulnerability is classified as an SQL Injection (CWE-89). It occurs when the plugin fails to properly clean user-provided data before using it in database queries. An attacker can exploit this weakness to submit malicious commands, potentially allowing them to read sensitive information stored in the database or interfere with how the application functions.

How is this SQL injection vulnerability triggered?

An attacker triggers the flaw by sending specially crafted input into the plugin's marketing forms. Crucially, the attacker does not need to have a user account or be logged in to send these requests. The bug is specifically related to form data processing; standard site browsing or visiting pages that do not interact with these specific form inputs will not trigger the vulnerability.

Is my website at risk from this vulnerability?

Halo Surface Signal indicates that because this plugin is designed for public-facing marketing forms, it is inherently internet-accessible. If your website uses the affected plugin and is reachable from the public internet, the application is likely exposed to this threat, as remote attackers can reach the vulnerable entry points directly over the network.

Do I need to take action if I use this plugin?

Yes, you should prioritize this issue. Start by identifying all web applications running this plugin version. Confirm which instances are internet-facing to gauge the immediate risk, then coordinate with your technical team to plan a update or temporary mitigation during your next maintenance cycle to secure the database connection.

References

patchstack.com/database/wordpress/plugin/smart-marketing-for-wp/vuln…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.