What is the CVSS score of CVE-2026-16087?

CVE-2026-16087 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Icegram Engage CVE-2026-16087

EUVD-2026-51742 MEDIUM

SQL Injection (CWE-89)

2026-08-01 Wordfence

GHSA-353r-r23c-w3ph

WordPress SQLi Wordpress Plugin Icegram Icegram Engage Popups Optins Ctas Lead Generation

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Technical description explicitly gates the save action on Editor-level `edit_post` capability, warranting PR:H over vendor PR:L; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 01, 2026 - 08:58 vuln.today

CVE Published

Aug 01, 2026 - 07:49 cve.org

MEDIUM 6.5

DescriptionCVE.org

The Icegram Engage - Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is second-order: the malicious id value is first persisted to post meta via the save_campaign_preview() AJAX action (gated by a nonce check and edit_post capability, requiring Editor-level access or above), and only executed as SQL when a subsequent preview request triggers get_message_data() to interpolate the stored value directly into a SQL IN() clause without $wpdb->prepare() or integer casting.

AnalysisAI

Second-order SQL injection in the Icegram Engage WordPress plugin (all versions through 3.1.42) allows authenticated attackers holding sufficient WordPress role privileges to extract arbitrary data from the site database across two deliberate HTTP requests. A crafted messages[][id] value is first persisted to WordPress post meta through the save_campaign_preview() AJAX action, then later interpolated unescaped into a SQL IN() clause inside get_message_data() during a subsequent preview request - bypassing $wpdb->prepare() entirely. No public exploit code or CISA KEV listing exists at time of analysis; Wordfence reported the issue with a CVSS 6.5 base score reflecting high confidentiality impact against an unchanged scope.

Technical ContextAI

The vulnerability (CWE-89, SQL Injection) resides in the lite edition of the Icegram Engage - Popups, Optins, CTAs & Lead Generation WordPress plugin (CPE: cpe:2.3:a:icegram:icegram_engage_-_popups,_optins,_ctas_&_lead_generation:*:*:*:*:*:*:*:*). Two distinct files form the attack surface. The injection sink is lite/classes/class-icegram-campaign-admin.php at line 1134, inside save_campaign_preview(), which accepts the attacker-controlled messages[][id] array via an AJAX POST and persists it to WordPress post meta after only a nonce and capability check. The execution sink is lite/class-icegram.php at lines 1338, 1720, and 1770, where get_message_data() reads the stored ID back from post meta and embeds it directly into a SQL IN() clause without calling $wpdb->prepare() or applying integer casting. The root cause is a classic deferred-injection pattern: storage and execution are separated across request boundaries, making automated scanners that test persistence and query execution in a single pass less likely to flag it. Because no sanitization converts the stored value to a safe integer before SQL embedding, arbitrary SQL fragments - including UNION SELECT and stacked queries - can be appended.

RemediationAI

An upstream fix is available in WordPress plugin repository changeset 3628434 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3628434%40icegram&new=3628434%40icegram); the exact released version number above 3.1.42 is not independently confirmed from available data, so administrators should update to the latest available version of Icegram Engage from the WordPress plugin repository and verify the installed version exceeds 3.1.42. If an immediate update is not possible, restrict the WordPress Editor role to the minimum number of trusted accounts necessary, since the edit_post capability on campaign posts is the prerequisite gate - reducing the Editor user population limits exposure. A WAF rule blocking SQL metacharacters (quotes, comment markers, UNION keywords) in the messages[][id] POST parameter provides partial defense-in-depth but should not substitute for patching, as bypass techniques exist. Blocking or rate-limiting requests to the save_campaign_preview AJAX action in wp-admin/admin-ajax.php is a more aggressive mitigation that will break the campaign preview feature as a side effect.