PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-15951 icegram CVE debrief

The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the Icegram_Mailer_Logs_Table::get_logs() function. The vulnerability allows authenticated attackers with Administrator-level access to append additional SQL queries into existing queries, potentially leading to sensitive information disclosure. To verify, review the plugin's code and database interactions, and monitor for suspicious activity. Affected administrators should prioritize patching or restricting access to the plugin.

Vendor
icegram
Product
Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs
CVSS
MEDIUM 4.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-01
Original CVE updated
2026-08-01
Advisory published
2026-08-01
Advisory updated
2026-08-01

Who should care

Administrators and users of the Icegram Mailer plugin for WordPress, particularly those with Administrator-level access, should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes reviewing and restricting access to the plugin's functionality, implementing additional monitoring for database queries, and applying vendor patches or updates when available. Furthermore, security teams and vulnerability management teams should prioritize this vulnerability and ensure that affected systems are remediated promptly.

Technical summary

The Icegram Mailer plugin for WordPress, versions up to and including 1.0.12, contains a SQL Injection vulnerability in the Icegram_Mailer_Logs_Table::get_logs() function. User-supplied input from the 'fields' parameter is not properly escaped, enabling SQL injection attacks by authenticated attackers with Administrator-level access. This could lead to unauthorized database queries and potential data breaches. Defenders should review the plugin's code, particularly the Icegram_Mailer_Logs_Table::get_logs() function, and apply patches or updates as available.

Defensive priority

Authenticated attackers with Administrator-level access could exploit this vulnerability to extract sensitive information from the database.

Recommended defensive actions

  • Inventory and version checks for Icegram Mailer plugin
  • Restrict access to the plugin's functionality to authorized personnel
  • Implement additional monitoring for database queries
  • Apply vendor patches or updates when available
  • Consider using a Web Application Firewall (WAF) to detect and prevent SQL injection attacks

Evidence notes

The vulnerability exists in the Icegram Mailer plugin for WordPress, specifically in the Icegram_Mailer_Logs_Table::get_logs() function. The function does not properly escape user-supplied input from the 'fields' parameter, allowing for SQL injection attacks. This issue was identified in versions up to, and including, 1.0.12. To verify the vulnerability, defenders should review the plugin's code and database interactions. Additionally, they should check for any existing patches or updates and monitor their systems for suspicious activity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-15951 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-15951

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-15951 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-15951

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/icegram-mailer/tags/1.0.12/includes/class-icegram-mailer-router.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/icegram-mailer/tags/1.0.12/includes/controllers/class-icegram-mailer-dashboard-controller.php

    [email protected]

  • Source reference

    Unverified legacy reference

    URL: https://plugins.trac.wordpress.org/browser/icegram-mailer/tags/1.0.12/includes/db/class-icegram-mailer-logs-table.php

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.