CVE-2026-94174 Overview
CVE-2026-94174 is a SQL injection vulnerability in the Email Log plugin for WordPress, affecting versions up to and including 2.63. The flaw allows an authenticated user with administrator privileges to inject arbitrary SQL statements into database queries executed by the plugin. Successful exploitation impacts confidentiality of stored data and can affect availability of the WordPress instance. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
An authenticated administrator can execute arbitrary SQL against the WordPress database, exposing sensitive content and potentially disrupting site operations.
Affected Products
- WordPress Email Log plugin versions up to and including 2.63
- WordPress sites with the Email Log plugin installed and enabled
- Multi-site WordPress deployments where administrators install the affected plugin
Discovery Timeline
- 2026-09-23 - CVE-2026-94174 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-94174
Vulnerability Analysis
The Email Log plugin logs and manages outbound email messages sent from WordPress. Versions up to 2.63 contain a SQL injection weakness reachable by authenticated administrators. User-controlled input reaches a database query without proper parameterization or escaping. The scope change reflected in the vulnerability metadata indicates that impact extends beyond the vulnerable component to other database contents. Because the attack requires administrator privileges, exploitation typically follows credential compromise, session hijacking, or misuse by a rogue insider.
Root Cause
The root cause is improper neutralization of special SQL elements in query construction, classified under CWE-89. The plugin passes attacker-controlled parameters into a SQL statement without using the WordPress $wpdb->prepare() API or equivalent parameter binding. Refer to the Patchstack advisory for the specific sink and parameter details.
Attack Vector
Exploitation occurs over the network against the WordPress admin interface. An authenticated administrator submits crafted parameters to a plugin endpoint. The malicious input is concatenated into a SQL statement, allowing UNION-based, boolean-based, or stacked queries depending on the sink. Attackers can extract user records, credentials, and post metadata, or issue statements that degrade site availability.
No verified proof-of-concept code is publicly available.
Refer to the Patchstack advisory linked in the references for
technical parameter and payload details.
Detection Methods for CVE-2026-94174
Indicators of Compromise
- Unusual SQL fragments such as UNION SELECT, SLEEP(, or INFORMATION_SCHEMA in WordPress admin request parameters targeting Email Log endpoints.
- Unexpected outbound queries against wp_users or wp_usermeta originating from PHP-FPM workers handling admin requests.
- Database error messages logged by the plugin or WordPress debug log referencing malformed queries from Email Log actions.
Detection Strategies
- Enable WordPress and web server access logging, and inspect POST and GET parameters submitted to Email Log admin endpoints for SQL metacharacters.
- Deploy a web application firewall rule set that flags SQL injection patterns targeting /wp-admin/ paths associated with the plugin.
- Correlate administrator authentication events with subsequent database anomalies to identify credential misuse.
Monitoring Recommendations
- Alert on administrator logins from new IP addresses, geographies, or user agents.
- Monitor MySQL slow query and error logs for statements originating from Email Log plugin execution paths.
- Track plugin version inventory across WordPress fleets to identify hosts still running Email Log 2.63 or earlier.
How to Mitigate CVE-2026-94174
Immediate Actions Required
- Update the Email Log plugin to a version later than 2.63 as soon as a fixed release is available from the vendor.
- Audit WordPress administrator accounts, remove unused accounts, and enforce multi-factor authentication for all remaining administrators.
- Review WordPress and database logs for evidence of prior SQL injection attempts against Email Log endpoints.
Patch Information
Consult the Patchstack advisory for the Email Log plugin for the fixed version and upgrade guidance. Apply the vendor patch through the WordPress plugin manager or by replacing plugin files with the fixed release.
Workarounds
- Deactivate and remove the Email Log plugin until a patched version is deployed.
- Restrict /wp-admin/ access by IP allowlisting at the reverse proxy or web server layer.
- Deploy virtual patching through a WAF rule that blocks SQL metacharacters in parameters bound for Email Log admin endpoints.
# Disable the Email Log plugin via WP-CLI until a patched version is installed
wp plugin deactivate email-log
wp plugin delete email-log
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
