CVE-2024-2876: Email Subscribers Plugin SQLi Vulnerability

CVE-2024-2876 Overview

The Email Subscribers by Icegram Express plugin for WordPress contains a critical SQL Injection vulnerability in the run function of the IG_ES_Subscribers_Query class. This flaw affects all versions up to and including 5.7.14 and stems from insufficient escaping of user-supplied parameters combined with a lack of proper SQL query preparation. The vulnerability allows unauthenticated attackers to inject malicious SQL queries, potentially extracting sensitive information from the WordPress database.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive data including user credentials, email lists, and other confidential information stored in the WordPress database without requiring any authentication.

Affected Products

• Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin versions ≤ 5.7.14
• WordPress installations utilizing the vulnerable Icegram Express plugin
• WooCommerce stores with Email Subscribers integration enabled

Discovery Timeline

• 2024-05-02 - CVE-2024-2876 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-2876

Vulnerability Analysis

This SQL Injection vulnerability exists within the IG_ES_Subscribers_Query class, specifically in the run function located in class-ig-es-subscriber-query.php. The core issue is the direct incorporation of user-controlled input into SQL queries without proper sanitization or parameterized query preparation.

WordPress plugins should utilize the $wpdb->prepare() method to safely handle user input in database queries. However, the Icegram Express plugin failed to implement this security measure adequately, leaving the subscriber query functionality exposed to injection attacks.

The vulnerability is particularly dangerous because it can be exploited by unauthenticated users, meaning no login credentials or special privileges are required to attempt an attack. This significantly expands the potential attack surface to anyone who can send HTTP requests to the affected WordPress installation.

Root Cause

The root cause of this vulnerability is twofold:

1. Insufficient Input Escaping: User-supplied parameters are not properly escaped before being incorporated into SQL queries. The plugin does not adequately sanitize special characters that could be used to break out of the intended query context.

2. Lack of Prepared Statements: The existing SQL query lacks proper preparation using WordPress's built-in $wpdb->prepare() function, which would normally bind parameters safely and prevent SQL injection.

The vulnerable code path can be traced through the admin class at class-email-subscribers-admin.php (line 1433) down to the subscriber query class at class-ig-es-subscriber-query.php (line 304), where the actual query execution occurs.

Attack Vector

The attack is conducted over the network and requires no authentication. An attacker can craft malicious HTTP requests containing SQL injection payloads targeting the subscriber query functionality. The attack flow typically involves:

1. Identifying an endpoint that processes subscriber queries
2. Injecting SQL syntax into parameters processed by the run function
3. Appending additional SQL queries to extract database contents
4. Iteratively exfiltrating sensitive data through boolean-based, time-based, or UNION-based injection techniques

The vulnerability enables attackers to perform various malicious database operations including data extraction, enumeration of database structure, and potentially accessing credentials or other sensitive WordPress data.

Detection Methods for CVE-2024-2876

Indicators of Compromise

• Unusual database queries in MySQL slow query logs or general logs containing SQL injection patterns
• Web server access logs showing requests with SQL syntax characters (', ", --, UNION, SELECT) in subscriber-related endpoints
• Unexpected database errors in WordPress error logs related to malformed queries
• Evidence of data exfiltration or unauthorized access to subscriber email lists

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP requests targeting WordPress plugin endpoints
• Enable and monitor MySQL query logging for anomalous query patterns, especially those containing multiple statements or unusual JOIN/UNION operations
• Implement file integrity monitoring on the Icegram Express plugin directory to detect unauthorized modifications
• Review WordPress and web server access logs for suspicious request patterns targeting subscriber functionality

Monitoring Recommendations

• Configure real-time alerting for SQL error messages in application logs
• Monitor database connection counts and query execution times for anomalies indicating blind SQL injection attempts
• Establish baseline behavior for subscriber query endpoints and alert on deviations
• Integrate WordPress security plugins with SIEM solutions for centralized threat detection

How to Mitigate CVE-2024-2876

Immediate Actions Required

• Update the Email Subscribers by Icegram Express plugin to version 5.7.15 or later immediately
• If immediate patching is not possible, consider temporarily disabling the plugin until the update can be applied
• Review database access logs for any evidence of exploitation
• Conduct a security assessment of the WordPress database to check for unauthorized data access or modifications

Patch Information

The vulnerability has been addressed in the official plugin update. The security fix can be reviewed in the WordPress Trac Changeset which implements proper input sanitization and prepared statements.

For detailed vulnerability information, refer to the Wordfence Vulnerability Report.

Additional technical context is available in the plugin source code:

• Email Subscribers Admin Class
• Subscriber Query Class

Workarounds

• Deploy a Web Application Firewall (WAF) with SQL injection rules to filter malicious requests while awaiting patching
• Restrict access to the WordPress admin and AJAX endpoints using IP allowlisting where feasible
• Implement database user privilege restrictions to limit the potential impact of successful SQL injection
• Enable WordPress security plugins with real-time threat detection capabilities

# Configuration example
# Add to .htaccess to restrict access to admin-ajax.php (use with caution)
<Files admin-ajax.php>
    Order deny,allow
    Deny from all
    Allow from 192.168.1.0/24
</Files>

# Or use ModSecurity rule to detect SQL injection patterns
SecRule ARGS "@detectSQLi" "id:1001,phase:2,deny,status:403,log,msg:'SQL Injection Attempt Detected'"