Critical · published May 2, 2024
CVSS calls it critical at 9.8. It sits in the 99.6th percentile for exploit probability.
🔥 An unauthenticated SQL injection vulnerability in the Email Subscribers by Icegram Express plugin could let attackers tap into your database like a thief rifling through your mail! Think of it like an unchecked delivery driver accepting any package without verifying the contents. Instead of delivering only your newsletters, they could bring in harmful queries that expose sensitive data! If exploited, attackers could insert their own SQL commands into the existing queries, potentially leaking sensitive information from your database. This level of access could lead to an absolute disaster, giving intruders a peek at user data or even full control over your site!
Think of it like an unchecked delivery driver accepting any package without verifying the contents. Instead of delivering only your newsletters, they could bring in harmful queries that expose sensitive data! The vulnerability exists in the 'run' function of the 'IG_ES_Subscribers_Query' class due to insufficient parameter escaping, allowing for unauthorized SQL statements to be appended to existing queries.
If exploited, attackers could insert their own SQL commands into the existing queries, potentially leaking sensitive information from your database. This level of access could lead to an absolute disaster, giving intruders a peek at user data or even full control over your site! Update the Email Subscribers by Icegram Express plugin to version 5.7.15 or later immediately. Additionally, review and sanitize user inputs in SQL statements to prevent similar vulnerabilities. Don't forget to monitor your database for any suspicious activity! You've got this! Follow these steps to lock this vulnerability down and keep your site safe! 🛡️