CVE-2026-1651

Vulnerability

Details The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL injection in all versions up to and including 5.9.16. The flaw resides in the update_status() function within /lite/includes/workflows/db/class-es-db-workflows.php. The workflow_ids parameter is passed through esc_sql(), which only escapes quotes and backslashes, but is insufficient for SQL injection in an IN clause context where numeric values do not require quotes. This allows authenticated attackers with administrator-level access to inject arbitrary SQL queries.

Exploitation

An attacker with administrator privileges can supply a malicious value for workflow_ids via the WordPress admin interface. The insufficient sanitization permits the injection of additional SQL statements into the existing query. No network-level authentication is required beyond the admin session, and the attacker can exploit this remotely.

Impact

Successful exploitation enables the attacker to extract sensitive information from the database, such as user credentials, email lists, and other private data. The CVSS score for this vulnerability is 6.5 (Medium) in the original CVE, though the reference rates it as 7.2 (High) under CVSS:3.1 [1].

Mitigation

Users should update to a patched version if available. The vendor has not yet released a fix addressing the flaw in version 5.9.16 and earlier. Until a patch is applied, administrators should limit access to trusted users and review any custom modifications.