Email Subscribers Vulnerable to Time-Based SQL Injection

CVE-2024-5756

What is CVE-2024-5756?

The Email Subscribers by Icegram Express plugin for WordPress, used for email marketing and automation, contains a vulnerability that allows for time-based SQL Injection. The flaw exists due to insufficient escaping of the user-supplied 'db' parameter and inadequate preparation of SQL queries in all versions up to 5.7.23. This weakness permits unauthenticated attackers to insert additional SQL commands into existing queries, potentially leading to the exposure of sensitive data stored within the WordPress database. It is crucial for users of this plugin to review their security measures and apply necessary updates to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References