CVE-2026-16087 icegram CVE debrief

Who should care

Administrators of WordPress installations using the Icegram Engage plugin, security teams monitoring for SQL injection attacks, users with contributor-level access to affected systems, and anyone responsible for vulnerability management and database security should be aware of this vulnerability. They should assess their exposure, apply mitigations, and monitor for potential attacks. Additionally, security teams should review logs for suspicious database queries, and developers should ensure that similar vulnerabilities are addressed in other plugins or custom codebases.

Technical summary

The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Parameter in all versions up to, and including, 3.1.42. This vulnerability allows authenticated attackers with contributor-level access and above to inject malicious SQL queries. The vulnerability arises from insufficient escaping of user-supplied parameters and the lack of preparation on existing SQL queries. The attack involves a two-step process: first, the malicious id value is saved to post meta through an AJAX action, and second, the stored value is executed as SQL when previewing messages. This can lead to sensitive information disclosure from the database.

Defensive priority

Medium priority due to the CVSS score of 6.5 and the potential for sensitive information disclosure.

Recommended defensive actions

• Apply the latest patch or update to version 3.1.43 or later.
• Restrict access to the plugin's functionality to trusted users only.
• Monitor database queries for suspicious activity.
• Consider using a Web Application Firewall (WAF) to detect and prevent SQL injection attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in the Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress, up to version 3.1.42. The issue is caused by insufficient escaping of user-supplied parameters and lack of preparation on existing SQL queries. This second-order SQL injection vulnerability allows authenticated attackers with contributor-level access and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The malicious id value is first persisted to post meta via the save_campaign_preview() AJAX action (gated by a nonce check and edit_post capability, requiring Editor-level access or above), and only executed as SQL when a subsequent preview request triggers get_message_data() to interpolate the stored value directly into a SQL IN() clause without $wpdb->prepare() or integer casting. To verify, defenders should review the plugin's database interactions, check for suspicious SQL queries, and monitor for potential data exfiltration attempts.

Official resources