CVE-2024-37252CWE-89

WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - SQL Injection vulnerability

Critical · published June 26, 2024

CVSS v3.1
9.3
EPSS
1%
Percentile
44.4
In the wild
Unconfirmed
What it is

🚨 An SQL injection flaw lurks in Icegram Email Subscribers & Newsletters, affecting versions up to 5.7.25! 🚨 Just imagine what a crafty attacker could do with this! Think of it like a restaurant that accepts orders without checking the IDs of its customers. An imposter could easily slip in an outrageous dish request and change the entire menu — or worse, poison it! An attacker could exploit this vulnerability to inject malicious SQL commands, potentially gaining unfettered access to your database. This could lead to data theft, loss of sensitive information, or even complete control over your system. That’s absolutely devastating for any organization!

Put simply

Think of it like a restaurant that accepts orders without checking the IDs of its customers. An imposter could easily slip in an outrageous dish request and change the entire menu — or worse, poison it! This SQL injection vulnerability allows attackers to manipulate SQL queries executed by the application, bypassing security measures and accessing unauthorized data.

What to do

An attacker could exploit this vulnerability to inject malicious SQL commands, potentially gaining unfettered access to your database. This could lead to data theft, loss of sensitive information, or even complete control over your system. That’s absolutely devastating for any organization! Immediate action is crucial! Update your Icegram Email Subscribers & Newsletters to the latest version, ensuring it’s patched. Also, review and sanitize all input fields to prevent future injection attacks. 🔥 You've got this! With these steps, you'll be one step closer to fortifying your security fortress! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00536 · 44.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-06-26T10:13Z
EPSS history
Timeline
  • 26 JUN 10:13Z
    WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - SQL Injection vulnerability
    cvelistv5