CVE-2026-16087 Overview
CVE-2026-16087 is a second-order SQL injection vulnerability in the Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress. The flaw affects all versions up to and including 3.1.42. It resides in the handling of the messages[][id] parameter, which is persisted to post meta via the save_campaign_preview() AJAX action and later interpolated into a SQL IN() clause without $wpdb->prepare() or integer casting. Authenticated attackers with Contributor-level access or higher can append SQL statements to existing queries and extract sensitive data from the WordPress database. The weakness maps to [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated attackers can extract sensitive database contents, including credentials and personally identifiable information stored in WordPress tables.
Affected Products
- Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress
- All plugin versions up to and including 3.1.42
- WordPress sites where the plugin is installed and active with Contributor-or-higher accounts
Discovery Timeline
- 2026-08-01 - CVE-2026-16087 published to the National Vulnerability Database
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-16087
Vulnerability Analysis
The vulnerability is a second-order SQL injection. Untrusted input is stored first and executed later, which allows an attacker to bypass developers' assumptions that stored data is safe. The messages[][id] value is written to post meta by the save_campaign_preview() AJAX handler. That write path is gated by a nonce check and the edit_post capability, requiring Editor-level access. A subsequent preview request invokes get_message_data(), which reads the stored id value and inlines it into a SQL IN() clause. Because the query is neither prepared with $wpdb->prepare() nor cast to an integer, the injected payload executes against the database.
Root Cause
The root cause is insufficient escaping of user-supplied input combined with unsafe query construction. The affected code paths are documented at WordPress Icegram File Reference #1338, #1720, and #1770. The plugin trusts a persisted identifier and interpolates it directly into a SQL statement without parameterized binding.
Attack Vector
An authenticated user with Contributor-level access or higher submits a crafted messages[][id] value to the save_campaign_preview() AJAX endpoint. The malicious value is stored in post meta. When the preview action is later triggered, the stored value is interpolated into the IN() clause and executed. The attacker can then exfiltrate database contents through blind or UNION-based techniques. Full technical details are available in the Wordfence Vulnerability Analysis.
Detection Methods for CVE-2026-16087
Indicators of Compromise
- Post meta entries containing SQL syntax such as UNION, SELECT, SLEEP(, or comment sequences (--, #) in fields tied to Icegram campaign preview data.
- Web server access logs showing repeated POST requests to admin-ajax.php with action=save_campaign_preview from Contributor-or-higher accounts.
- Anomalous outbound queries or long-running database transactions originating from the WordPress database user around preview render events.
Detection Strategies
- Inspect the wp_postmeta table for stored values containing non-numeric characters where numeric IDs are expected, particularly for keys used by Icegram campaigns.
- Monitor MySQL general or slow-query logs for IN() clauses containing suspicious tokens such as UNION SELECT or time-based functions.
- Correlate WordPress user activity logs to identify Contributor or Editor accounts triggering save_campaign_preview followed by preview render requests.
Monitoring Recommendations
- Enable WordPress audit logging for AJAX actions and user role usage, with alerting on repeated campaign preview activity.
- Baseline normal admin-ajax.php request volumes and alert on deviations from Contributor and Editor accounts.
- Forward WordPress, PHP, and MySQL logs to a central analytics platform for correlation and retention.
How to Mitigate CVE-2026-16087
Immediate Actions Required
- Update the Icegram Engage plugin to a version later than 3.1.42 that includes the fix committed in the Icegram Changeset 3628434.
- Audit all Contributor, Author, and Editor accounts and remove or disable any that are unused or unrecognized.
- Rotate WordPress database credentials and any secrets that may have been readable through the affected queries.
Patch Information
The vendor addressed the vulnerability in the plugin release following 3.1.42. The fix corrects the affected code in class-icegram.php and class-icegram-campaign-admin.php, including the path referenced at WordPress Icegram Campaign Admin Reference #1134. Administrators should apply the update through the WordPress plugin management interface or by deploying the patched release from the plugin repository.
Workarounds
- Deactivate the Icegram Engage plugin until the patched version can be applied.
- Restrict Contributor and Editor role assignments to trusted users only, and require multi-factor authentication for those accounts.
- Deploy a web application firewall rule to block requests to admin-ajax.php where action=save_campaign_preview contains non-numeric characters in messages[][id].
# Example WP-CLI commands to update the plugin and audit privileged users
wp plugin update icegram
wp user list --role=editor --fields=ID,user_login,user_email,user_registered
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
