Unauthenticated SQL Injection in Email Subscribers by Icegram Express

CVE-2024-2876 is a critical security vulnerability identified in the Email Subscribers by Icegram Express plugin for WordPress. The flaw, which carries a CVSS score of 9.8, stems from insufficient input sanitization and inadequate parameter preparation within the IG_ES_Subscribers_Query class. An unauthenticated attacker can exploit this via the advanced_filter parameter in crafted HTTP POST requests to the plugin's endpoint. Successful exploitation allows for the execution of arbitrary SQL queries against the underlying database, facilitating unauthorized information extraction and modification. The vulnerability affects all versions of the plugin up to and including 5.7.14. Organizations utilizing this plugin are advised to upgrade to version 5.7.15 or later immediately.

Attack Chain

1. Attacker identifies a WordPress site with the vulnerable Email Subscribers plugin installed.
2. Attacker crafts an HTTP POST request targeting /wp-admin/admin-post.php.
3. Attacker includes specific parameters: page=es_subscribers, is_ajax=1, and action=_sent.
4. Attacker injects malicious SQL payloads into the advanced_filter[conditions][0][0][field] parameter.
5. The server-side code in IG_ES_Subscribers_Query processes the request without sufficient validation.
6. The database executes the injected SQL command, such as a UNION SELECT with a time-based delay (e.g., SLEEP).
7. The attacker parses the server's response to confirm successful injection or exfiltrate data from the database.

Impact

Successful exploitation of CVE-2024-2876 provides an unauthenticated attacker with the ability to perform full database extraction, modification, or destruction. Given the sensitive nature of email subscriber databases, this includes the theft of user lists, personal identifiers, and other stored content, impacting the privacy and integrity of the affected organization.

Recommendation

Prioritized actions for security teams:

• Update the Email Subscribers by Icegram Express plugin to version 5.7.15 or the latest available version immediately.
• Deploy the WAF rule below to identify and block exploit attempts targeting the advanced_filter parameter.
• Review web server access logs for anomalous POST requests to /wp-admin/admin-post.php containing SQL syntax characters (e.g., union, select, sleep).