EUVD-2026-85474
GHSA-g345-p4f8-r797
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain WordPress Administrator session
-
ExploitSubmit crafted parameter to Email Log admin endpoint
-
ExecutionInjected SQL executes in plugin query
-
ImpactExtract database contents (hashes/secrets)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress Administrator session on a site running the Email Log plugin version ≤2.63 (PR:H). The attacker sends a crafted request to a vulnerable Email Log admin function whose parameter is concatenated into a SQL query without sanitization (CWE-89). No user interaction (UI:N) and no unusual server configuration are needed beyond having the plugin installed and active. The dominant limiting factor is the Administrator privilege prerequisite, which excludes unauthenticated and low-privilege users and confines abuse to malicious admins or post-credential-theft scenarios. |
| Impact | This is a genuine but low-urgency issue whose severity is capped by its own privilege prerequisite. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, base 7.6) describes network-reachable, low-complexity SQL injection, but PR:H means the attacker must already hold Administrator-level access to WordPress - the highest trust tier in the application. An actor with admin rights can already read the database through legitimate features, so the marginal risk added by this flaw is modest; its main value is as a post-compromise or malicious-insider primitive rather than an initial-access vector. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied intelligence, so there is no signal of active or automatable exploitation. I also disagree with the vendor's S:C (scope change): SQL injection confined to the plugin's own database context is normally S:U, which would lower the base to roughly 6.5 - the S:C choice appears to inflate the score. Bottom line: real but low priority, not a high-real-risk issue despite the 7.6 rating. |
| Exploit ScenarioDerived | A user who already holds WordPress Administrator privileges (a rogue admin, or an attacker who compromised admin credentials via another vector) submits a crafted parameter to a vulnerable Email Log admin request, injecting SQL that the plugin passes unsanitized into a database query. This lets them extract arbitrary database contents (user hashes, secrets) beyond the plugin's intended data. No public exploit code was identified at time of analysis, and exploitation requires the high-privilege session, sharply limiting realistic use. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
SQL injection in the WordPress plugin Email Log (versions ≤2.63) lets an authenticated site Administrator execute crafted SQL against the underlying database through an admin-side parameter that is concatenated into a query without sanitization. Successful abuse is primarily a confidentiality problem - exfiltration of subscriber addresses, message contents and other stored WordPress data (C:H) - with some availability risk (A:L) and no demonstrated integrity impact; the independent assessment retains scope unchanged (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L) rather than the scope-changed 7.6 originally reported, and rates it a genuine but low-urgency issue because exploitation presupposes Administrator credentials. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV entry; no EPSS data supplied by the sources reviewed), so the practical threat is a malicious or compromised admin account rather than mass remote exploitation.
RemediationAI
No vendor-released patch version is identified in the available intelligence, so the first action is to confirm whether a patched Email Log release above 2.63 has since been published via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/email-log/vulnerability/wordpress-email-log-plugin-2-63-sql-injection-vulnerability) or the WordPress.org plugin page, and to upgrade to that version as soon as it is confirmed; do not assume 2.63 is the final affected release without checking. If no fix is yet available, the highest-value compensating control is removing exposure of the administrative attack surface: deactivate and delete the plugin on sites that do not need email logging (side effect: loss of historical deliverability/logging data unless exported first), and on sites that do need it, restrict the plugin's admin pages so only a minimal set of trusted accounts can reach them, enforce least-privilege WordPress roles, rotate Administrator credentials, and enable MFA for every admin account - this directly mitigates the observed exploitation path, which requires an Administrator session, but does not eliminate the underlying code defect for a determined or already-compromised admin. In addition, deploy virtual patching through a WAF or a WordPress security plugin rule set that targets SQL-injection patterns against the plugin's administrative endpoints; the trade-off is dependence on signature accuracy and potential false positives on legitimate admin requests, and virtual patching is a stopgap rather than a substitute for an upstream fix. Finally, review database and web server logs for anomalous SQL syntax or unexpected query errors originating from admin requests to Email Log endpoints as a detection and post-compromise measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Email Log is a WordPress logging plugin published by WebFactory that records outbound wp_mail() traffic in custom database tables, and it is matched by CPE cpe:2.3:a:webfactory:email_log:*:*:*:*:*:*:*:* with an affected range of ≤2.63 per the ENISA EUVD record (EUVD-2026-85474). The flaw is CWE-89 (SQL Injection): a parameter handled by one of the plugin's administrator-facing functions is interpolated directly into a SQL statement instead of being passed through $wpdb->prepare() or equivalent parameter binding, so attacker-controlled input reaches the database parser as executable SQL. Because the vulnerable path sits behind the WordPress administrative interface, the attacker must already hold an Administrator session (PR:H, UI:N, AV:N) - there is no unauthenticated or low-privilege route described in the available data. Patchstack reports the issue (tagged SQLi / Email Log); the CVSS:3.1 vector originally attached to the record (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, score 7.6) claimed a scope change, which this independent reassessment does not confirm, keeping S:U and therefore a lower effective severity. The concatenation pattern is the classic root cause class in WordPress plugin SQLi: no input validation on an administrative request parameter combined with string-built queries, which is also why simple WAF signature coverage for the plugin's admin endpoints is a practical interim control.
Know when Email Log gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Network-reachable low-complexity SQLi requiring admin (PR:H); scope unchanged (S:U) as injection stays within the plugin DB context; database read gives C:H, no integrity impact, minor A:L.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Administrator SQL Injection in Email Log <= 2.63 versions.
Executive ViewAI
A high-severity SQL injection flaw in the WordPress plugin Email Log (versions 2.63 and earlier) allows anyone holding site Administrator credentials to pull stored subscriber addresses, email message contents, and other WordPress data directly out of the underlying database. Because abuse requires an already-privileged Administrator account, the realistic exposure is an insider, a compromised admin login, or a malicious contractor rather than an outside attacker - but the data at risk is customer/subscriber personally identifiable information, which carries privacy, contractual, and reputational consequences. No vendor patch is currently available, so leadership should treat this as a manageable but unresolved exposure requiring immediate credential and access controls.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Administrator accounts to the minimum trusted staff, enforce MFA and credential rotation, deactivate or remove the Email Log plugin (≤2.63) where not essential, apply WAF/virtual-patching rules against the plugin's admin-side parameters, and monitor administrative database activity for anomalous or bulk data extraction.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
The Email Log WordPress plugin before 2.4.7 does not properly validate, sanitise and escape the "orderby" and "order" GE
The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in
Exploit-DB