Email Subscribers by Icegram Express WordPress Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Email Subscribers by Icegram Express plugin for WordPress, affecting all versions through 5.9.16. The issue arises from inadequate escaping of user-supplied data in the 'workflow_ids' parameter, allowing authenticated attackers with administrator privileges to inject additional SQL queries. This exploitation could lead to unauthorized access to sensitive database information.

Impact

Exploitation of this vulnerability allows authenticated administrators to execute arbitrary SQL commands, potentially leading to extraction or manipulation of database information. In a proof-of-concept, the vulnerability was used to extract the password hash of an admin user.

Reproduction

To reproduce this vulnerability, an authenticated user with administrator privileges can send a request to the WordPress AJAX endpoint 'wp_ajax_icegram-express' with the 'workflow_ids' parameter. The injected SQL payload can be crafted to extract sensitive information from the database, such as user password hashes.

Remediation

Users are advised to update the Email Subscribers by Icegram Express plugin to version 5.9.17 or later.