CVE-2024-4845: Icegram Express SQL Injection Vulnerability

CVE-2024-4845 Overview

CVE-2024-4845 is an authenticated SQL injection vulnerability in the Icegram Express plugin for WordPress. The flaw affects all plugin versions up to and including 5.7.22. The vulnerability exists in the handling of the options[list_id] parameter, which lacks proper escaping and query preparation. Authenticated attackers with Subscriber-level access or higher can append arbitrary SQL statements to existing queries. Successful exploitation allows extraction of sensitive data from the WordPress database, including user credentials, session tokens, and configuration secrets. The issue is tracked as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers holding only Subscriber accounts can extract arbitrary data from the WordPress database, including password hashes and secret keys.

Affected Products

Icegram Express plugin for WordPress, versions * through 5.7.22
WordPress sites with the email-subscribers plugin package installed
Any WordPress deployment permitting Subscriber-level registration alongside the vulnerable plugin

Discovery Timeline

2024-06-12 - CVE-2024-4845 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4845

Vulnerability Analysis

The vulnerability resides in code paths that consume the options[list_id] request parameter and concatenate it into an SQL statement without adequate sanitization or parameterization. Because the plugin ships with subscription and list-management endpoints reachable by any authenticated user, low-privileged accounts can reach the vulnerable sink. An attacker submits a crafted list_id payload containing SQL syntax such as UNION SELECT clauses. The database then returns rows from arbitrary tables in the WordPress schema. This yields access to the wp_users table for password hashes and the wp_options table for API keys and site secrets. The plugin fix, delivered in WordPress Change Log Entry, applies proper prepared statements and input casting.

Root Cause

The root cause is insufficient escaping of user-supplied input combined with the absence of $wpdb->prepare() placeholders. The plugin trusted the options[list_id] value as a numeric identifier without casting it to an integer or binding it as a query parameter. Attackers can supply string payloads that break out of the intended query context.

Attack Vector

The attack vector is network-based and requires low privileges. An attacker authenticates to a WordPress instance as a Subscriber, which is often available through open user registration. The attacker then issues an HTTP request to the vulnerable plugin endpoint with a malicious options[list_id] value. No user interaction is required, and the exploit runs against a single request. Refer to the Wordfence Vulnerability Report for the disclosed request path and payload structure.

// No verified public proof-of-concept code is available for CVE-2024-4845.
// See the Wordfence advisory linked above for parameter and endpoint details.

Detection Methods for CVE-2024-4845

Indicators of Compromise

HTTP requests to Icegram Express endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, or INFORMATION_SCHEMA inside the options[list_id] parameter
New or unexpected Subscriber-level WordPress accounts created shortly before suspicious plugin requests
Database error entries or unusually long query execution times in MySQL slow query logs referencing plugin tables such as wp_ig_lists

Detection Strategies

Inspect WordPress access logs for POST or GET requests to admin-ajax.php and Icegram Express handlers that include unusual characters (', --, %20, 0x) within options[list_id]
Deploy a web application firewall rule that blocks non-integer values submitted to the options[list_id] parameter
Correlate authenticated session identifiers with anomalous query patterns to isolate low-privileged accounts probing the plugin

Monitoring Recommendations

Enable MySQL general or audit logging on affected sites and alert on queries containing UNION SELECT originating from PHP-FPM workers serving WordPress
Monitor the wp_users and wp_usermeta tables for read spikes from the plugin's database user
Track plugin version inventory across all WordPress hosts and flag any deployment still running Icegram Express at or below 5.7.22

How to Mitigate CVE-2024-4845

Immediate Actions Required

Update the Icegram Express plugin to a version newer than 5.7.22 on every WordPress site in the environment
Audit existing WordPress accounts and remove unrecognized Subscriber-level users created during the exposure window
Rotate WordPress administrator passwords, secret keys in wp-config.php, and any API tokens stored in wp_options

Patch Information

The vendor addressed the vulnerability in the plugin release documented in the WordPress Change Log Entry. The patch replaces unsafe string concatenation with prepared statements and enforces integer casting on the list_id value. Administrators should apply the update through the WordPress plugin manager or by pulling the fixed release from the WordPress.org repository.

Workarounds

Disable open user registration in WordPress under Settings > General until patching is complete
Deactivate the Icegram Express plugin on hosts where an immediate update is not feasible
Restrict access to the plugin's AJAX endpoints using web server rules that require administrator-level cookies

bash

# Update the Icegram Express plugin using WP-CLI
wp plugin update email-subscribers --version=latest

# Verify the installed version is above 5.7.22
wp plugin get email-subscribers --field=version

# Temporarily disable open registration as a workaround
wp option update users_can_register 0