A critical unauthenticated SQL injection vulnerability has been identified in the Smart Marketing SMS and Newsletters Forms WordPress plugin, affecting versions up to and including 5.1.24. The vulnerability allows unauthenticated attackers to execute arbitrary SQL queries against the database without requiring any credentials. This type of vulnerability can lead to unauthorized data access, data exfiltration, and potentially full database compromise. The issue was reported via NVD and documented by Patchstack. Users of the affected plugin are advised to update to a patched version immediately. The vulnerability is classified as high severity given the unauthenticated nature of the exploit vector.
