PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110532 Mail Mage CVE debrief

The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks. This vulnerability affects WordPress installations with the Mail Mage plugin version 0.0.25 or earlier, potentially leading to data breaches or other malicious activities. Defenders should verify exposure and assess the risk of SQL injection attacks. The CVE record and NVD entry provide details on the vulnerability, but additional verification is required to confirm affected scope, severity, and vendor guidance.

Vendor
Mail Mage
Product
Mail Mage WordPress plugin
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-11-06
Original CVE updated
2026-11-06
Advisory published
2026-11-06
Advisory updated
2026-11-06

Who should care

Defenders responsible for WordPress installations with the Mail Mage plugin version 0.0.25 or earlier should assess exposure and risk of SQL injection attacks.

Why it matters

The Mail Mage WordPress plugin vulnerability allows unauthenticated attackers to perform SQL injection attacks, which could lead to data breaches or other malicious activities.

  • Verify exposure of the Mail Mage WordPress plugin version 0.0.25 or earlier
  • Assess the risk of SQL injection attacks
  • Review and update the Mail Mage WordPress plugin to a version that addresses the vulnerability

Technical summary

The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks. This vulnerability is relevant to defenders responsible for WordPress installations with the Mail Mage plugin version 0.0.25 or earlier. The vulnerability allows attackers to inject malicious SQL code, potentially leading to data breaches or other malicious activities. Defenders should prioritize verifying exposure and assessing the risk of SQL injection.

Defensive priority

Defenders should prioritize verifying exposure of the Mail Mage WordPress plugin version 0.0.25 or earlier in their environment and assess the risk of SQL injection attacks.

Recommended defensive actions

  • Verify exposure of the Mail Mage WordPress plugin version 0.0.25 or earlier in the environment
  • Assess the risk of SQL injection attacks
  • Review and update the Mail Mage WordPress plugin to a version that addresses the vulnerability

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the Mail Mage WordPress plugin. However, the corpus does not establish versions beyond 0.0.25, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110532 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110532

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110532 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110532

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.