CVE-2026-15951 Overview
CVE-2026-15951 is a SQL injection vulnerability in the Icegram Mailer plugin for WordPress, affecting all versions up to and including 1.0.12. The flaw resides in the Icegram_Mailer_Logs_Table::get_logs() function, which joins user-controlled fields array elements directly into the SELECT clause via implode(). No whitelisting, escaping, or prepared-statement placeholders are applied. Authenticated attackers with Administrator-level access can append additional SQL to existing queries and extract sensitive data from the WordPress database. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated administrators can extract arbitrary data from the WordPress database, including user credentials, session tokens, and confidential site content stored in wp_users, wp_usermeta, and other tables.
Affected Products
- Icegram Mailer plugin for WordPress
- All versions up to and including 1.0.12
- WordPress sites running the vulnerable plugin with authenticated Administrator accounts
Discovery Timeline
- 2026-08-01 - CVE-2026-15951 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-15951
Vulnerability Analysis
The vulnerability exists in the plugin's log retrieval mechanism. The get_logs() function in class-icegram-mailer-logs-table.php accepts a fields array element from $_REQUEST['data'] and concatenates each element into the SELECT clause using PHP's implode(). Because the elements are inserted verbatim, an attacker can inject SQL fragments such as subqueries or UNION statements. The injected payload executes with the same database privileges as the WordPress application, exposing the entire database schema and contents.
With an EPSS score of 0.266%, the vulnerability is not currently exploited at scale, but its Administrator-level prerequisite makes it valuable in scenarios involving compromised admin accounts, insider threats, or chained privilege abuse.
Root Cause
The root cause is missing input validation and lack of parameterized queries. The plugin trusts client-supplied field names and passes them into the SQL statement without a whitelist of allowed column names, without calling esc_sql() or sanitize_key(), and without using $wpdb->prepare() placeholders. This violates WordPress database API guidance for dynamic identifiers.
Attack Vector
An authenticated attacker with Administrator privileges issues a crafted request to the plugin's dashboard endpoint. The data[fields][] parameter is populated with SQL fragments rather than legitimate column names. Because implode() joins these fragments with commas into the SELECT list, an attacker can add subqueries that read from other tables. The response returns the query results through the logs table view, delivering exfiltrated data back to the attacker.
Relevant source lines are documented in the WordPress Icegram Mailer Logs Code, the Dashboard Controller, and the Router.
Detection Methods for CVE-2026-15951
Indicators of Compromise
- HTTP POST or GET requests to WordPress admin endpoints containing data[fields][] parameters with SQL keywords such as SELECT, UNION, FROM, or subquery parentheses.
- Web server access logs showing unusually long or complex fields array values submitted to the Icegram Mailer dashboard route.
- Database query logs containing SELECT statements referencing WordPress tables like wp_users or wp_options from contexts not associated with the plugin's normal operation.
Detection Strategies
- Inspect WordPress request logs for admin-ajax.php or REST routes handled by class-icegram-mailer-router.php where the fields parameter contains characters like (, ,, or SQL keywords.
- Enable MySQL general query logging on staging environments to identify malformed SELECT statements originating from the plugin.
- Deploy a web application firewall rule that flags request parameters combining fields[] with SQL syntax tokens.
Monitoring Recommendations
- Alert on any Administrator-account activity that generates database errors or unusually large result sets from plugin endpoints.
- Track newly authenticated Administrator sessions from unfamiliar IP addresses or user agents.
- Correlate WordPress audit logs with database access patterns to identify data exfiltration attempts.
How to Mitigate CVE-2026-15951
Immediate Actions Required
- Update the Icegram Mailer plugin to a version above 1.0.12 once the vendor publishes a fixed release; monitor the WordPress Icegram Mailer Changeset for the patch.
- Audit all Administrator accounts and remove or downgrade any that do not require elevated privileges.
- Rotate WordPress user passwords, secret keys in wp-config.php, and any API tokens that may have been exposed through the vulnerable query.
Patch Information
Refer to the Wordfence Vulnerability Report for the authoritative advisory and patch status. Apply the fixed plugin version as soon as it becomes available in the WordPress plugin repository.
Workarounds
- Temporarily deactivate the Icegram Mailer plugin until a patched version is installed.
- Restrict access to the WordPress admin dashboard using IP allowlisting at the web server or WAF layer.
- Enforce multi-factor authentication for all Administrator accounts to reduce the risk of credential-based abuse of this vulnerability.
# Example: disable the plugin via WP-CLI until a patched release is available
wp plugin deactivate icegram-mailer
wp plugin status icegram-mailer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
