EUVD-2026-51410
GHSA-wjfc-ffhr-q953
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Admin authentication required (PR:H) over network (AV:N); successful injection yields full database read and write (C:H/I:H) with no availability disruption (A:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.
AnalysisAI
SQL injection in the Check & Log Email WordPress plugin (all versions before 2.0.15) allows authenticated WordPress administrators to execute arbitrary SQL queries against the underlying database via unsanitized parameters. With PR:H per the CVSS vector, exploitation is constrained to admin-level accounts, making the primary threat a rogue insider or a follow-on attack after admin credential compromise. A public proof-of-concept is available through WPScan; however, EPSS at 0.16% (6th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation campaign at time of analysis.
Technical ContextAI
CWE-89 (Improper Neutralization of Special Elements in SQL Commands) is the root cause: the plugin constructs SQL queries by concatenating user-supplied parameters without prepared statements or proper escaping, a classic second-order or direct injection pattern common in older WordPress plugin codebases. The affected product is identified by CPE cpe:2.3:a:unknown:check_&_log_email:*:*:*:*:*:*:*:*, covering all releases from the initial version up to but not including 2.0.15. The plugin's function - logging and inspecting outbound WordPress emails - means its database interactions likely touch wp_* tables containing message metadata, addresses, and potentially user-linked data, expanding the value of a successful injection beyond simple configuration reads.
RemediationAI
Upgrade Check & Log Email to version 2.0.15 or later, which is the vendor-released patch resolving improper SQL parameter handling. Patch details are documented at https://wpscan.com/vulnerability/7b39bae3-41a2-4862-b7c3-1a386273d600/. If immediate upgrade is not feasible, restrict WordPress administrator role assignment to the minimum necessary personnel and enforce multi-factor authentication on all admin accounts to reduce the likelihood of credential compromise that would enable exploitation. A Web Application Firewall (WAF) with SQLi signatures targeting wp-admin endpoints can add a detection layer but carries false-positive risk and should not substitute for patching. Deactivating the plugin entirely is an option if email logging is non-essential, eliminating the attack surface at the cost of losing log functionality.
More in Check Log Email
View allThe Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameter
The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back i
The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attr
Stored XSS vulnerability in Check & Log Email WordPress plugin before version 2.0.13 allows authenticated users with low
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today