SQL Injection Vulnerability in Icegram Mailer Plugin for WordPress
CVE-2026-15951

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
Icegram Mailer – Reliable Email Deliverability, No-code Smtp Replacement & Email Logs
Vendor
CVE Published:
1 August 2026

What is CVE-2026-15951?

The Icegram Mailer plugin for WordPress includes a SQL Injection vulnerability that affects versions up to and including 1.0.12. This flaw arises from inadequate escaping of user input, specifically in the 'fields' parameter utilized in the Icegram_Mailer_Logs_Table::get_logs() function. The existing SQL query does not properly prepare or whitelist the input received through $_REQUEST['data'], allowing authenticated users with Administrator privileges to inject malicious SQL queries. As a result, attackers can manipulate queries to extract sensitive data from the database, highlighting the need for improved security practices in handling SQL operations.

Affected Version(s)

Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs 0 <= 1.0.12

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/icegram-mailer...
https://plugins.trac.wordpress.org/browser/icegram-mailer...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.