PatchSiren cyber security CVE debrief
CVE-2026-15951 icegram CVE debrief
The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the Icegram_Mailer_Logs_Table::get_logs() function. The vulnerability allows authenticated attackers with Administrator-level access to append additional SQL queries into existing queries, potentially leading to sensitive information disclosure. To verify, review the plugin's code and database interactions, and monitor for suspicious activity. Affected administrators should prioritize patching or restricting access to the plugin.
- Vendor
- icegram
- Product
- Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs
- CVSS
- MEDIUM 4.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-01
- Original CVE updated
- 2026-08-01
- Advisory published
- 2026-08-01
- Advisory updated
- 2026-08-01
Who should care
Administrators and users of the Icegram Mailer plugin for WordPress, particularly those with Administrator-level access, should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes reviewing and restricting access to the plugin's functionality, implementing additional monitoring for database queries, and applying vendor patches or updates when available. Furthermore, security teams and vulnerability management teams should prioritize this vulnerability and ensure that affected systems are remediated promptly.
Technical summary
The Icegram Mailer plugin for WordPress, versions up to and including 1.0.12, contains a SQL Injection vulnerability in the Icegram_Mailer_Logs_Table::get_logs() function. User-supplied input from the 'fields' parameter is not properly escaped, enabling SQL injection attacks by authenticated attackers with Administrator-level access. This could lead to unauthorized database queries and potential data breaches. Defenders should review the plugin's code, particularly the Icegram_Mailer_Logs_Table::get_logs() function, and apply patches or updates as available.
Defensive priority
Authenticated attackers with Administrator-level access could exploit this vulnerability to extract sensitive information from the database.
Recommended defensive actions
- Inventory and version checks for Icegram Mailer plugin
- Restrict access to the plugin's functionality to authorized personnel
- Implement additional monitoring for database queries
- Apply vendor patches or updates when available
- Consider using a Web Application Firewall (WAF) to detect and prevent SQL injection attacks
Evidence notes
The vulnerability exists in the Icegram Mailer plugin for WordPress, specifically in the Icegram_Mailer_Logs_Table::get_logs() function. The function does not properly escape user-supplied input from the 'fields' parameter, allowing for SQL injection attacks. This issue was identified in versions up to, and including, 1.0.12. To verify the vulnerability, defenders should review the plugin's code and database interactions. Additionally, they should check for any existing patches or updates and monitor their systems for suspicious activity.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T09:17:00.000Z and has not been modified since then.