CVE-2026-77161 describes a SQL Injection vulnerability in the egoi Smart Marketing SMS and Newsletters Forms plugin for WordPress. The flaw arises from improper neutralization of special elements in SQL commands due to insufficient escaping of a user-supplied parameter and lack of adequate query preparation. Exploitation requires the plugin's sync feature to be enabled (options['enabled']) and get_option('egoi_mapping') to be truthy, which are typical configurations for the plugin's contact mapping functionality. Authenticated attackers with subscriber-level privileges or higher can append additional SQL queries to existing ones, potentially extracting sensitive data from the database. The vulnerability affects all versions up to and including 5.1.24.

An attacker with subscriber-level or higher access can exploit this vulnerability to perform SQL Injection attacks, enabling them to extract sensitive information from the database. The vulnerability does not impact integrity or availability but compromises confidentiality. Exploitation requires specific plugin configuration settings to be enabled, which are common in typical deployments.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the plugin's sync feature or the egoi_mapping option if feasible to reduce exposure. Limit subscriber-level access where possible and monitor for updates from the vendor.