Icegram Mailer Reliable Email Deliverability No Code Smtp Replacement Email Logs
Monthly
SQL injection in the Icegram Mailer WordPress plugin (versions up to and including 1.0.12) enables authenticated WordPress administrators to extract arbitrary data from the underlying database by manipulating the 'fields' parameter submitted to the email log view. The vulnerable code path in Icegram_Mailer_Logs_Table::get_logs() concatenates user-supplied array elements verbatim into a SQL SELECT clause via PHP implode() with no whitelist, escaping, or prepared-statement binding. No active exploitation has been confirmed (not listed in CISA KEV), no public POC is referenced, and a code-level fix is visible in the plugin's SVN repository at changeset 3627122, though the exact patched release version is not independently confirmed from available data.
SQL injection in the Icegram Mailer WordPress plugin (versions up to and including 1.0.12) enables authenticated WordPress administrators to extract arbitrary data from the underlying database by manipulating the 'fields' parameter submitted to the email log view. The vulnerable code path in Icegram_Mailer_Logs_Table::get_logs() concatenates user-supplied array elements verbatim into a SQL SELECT clause via PHP implode() with no whitelist, escaping, or prepared-statement binding. No active exploitation has been confirmed (not listed in CISA KEV), no public POC is referenced, and a code-level fix is visible in the plugin's SVN repository at changeset 3627122, though the exact patched release version is not independently confirmed from available data.