Icegram Mailer CVE-2026-15951

Exploitation requires an authenticated WordPress session with Administrator-level role or higher - Subscriber, Contributor, Author, and Editor roles cannot reach the vulnerable code path. The attack surface is the Icegram Mailer plugin's email log dashboard functionality, specifically the HTTP request parameter '$_REQUEST['data']' with a 'fields' array key, routed through the dashboard controller and into get_logs(). No special server-side configuration beyond having the Icegram Mailer plugin installed and active on a WordPress site is required. The primary factor limiting exploitation is the Administrator privilege prerequisite, which makes opportunistic or automated mass exploitation implausible. Realistic attack scenarios are bounded to: (1) insider threat by a legitimate admin, (2) exploitation following a separate admin credential compromise, or (3) multi-tenant WordPress hosting where one admin-level user attempts to pivot to another tenant's data.

The CVSS 3.1 score of 4.9 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N accurately reflects the constrained real-world risk. The high privilege requirement (PR:H - WordPress Administrator) is the dominant limiting factor: an attacker must already hold or compromise administrator-level credentials before the injection surface is reachable, making this a post-compromise data exfiltration path rather than an initial access vector. The network attack vector (AV:N) and low complexity (AC:L) indicate the exploit itself is straightforward once admin access exists, but that prerequisite substantially narrows the attack surface. No EPSS score is available in the provided data; KEV status is absent, confirming no known active exploitation. No POC is referenced, distinguishing this from higher-urgency findings. The confidentiality impact is high (full database read potential, including WordPress user hashes and site configuration), but integrity and availability are unaffected (I:N/A:N). In practical terms, this vulnerability matters most in insider-threat scenarios or after an admin account compromise - not as a standalone critical path. Environments with strict admin access controls and MFA face materially lower risk.

An attacker who has obtained WordPress administrator credentials - whether through phishing, credential stuffing, or a separate compromise - logs into the WordPress admin panel and navigates to the Icegram Mailer email log view. They submit a crafted HTTP POST/GET request with manipulated values in the 'data[fields][]' parameter, injecting additional SQL into the SELECT clause of the get_logs() query to enumerate database tables and extract sensitive data such as WordPress user password hashes or plugin configuration secrets. No public POC has been identified at time of analysis, but the injection point is straightforwardly exploitable given the absence of any sanitization.