Attack Chain

1. Attacker identifies a WordPress site with the vulnerable Email Subscribers plugin installed.
2. Attacker crafts an HTTP POST request targeting /wp-admin/admin-post.php.
3. Attacker includes specific parameters: page=es_subscribers, is_ajax=1, and action=_sent.
4. Attacker injects malicious SQL payloads into the advanced_filter[conditions][0][0][field] parameter.
5. The server-side code in IG_ES_Subscribers_Query processes the request without sufficient validation.
6. The database executes the injected SQL command, such as a UNION SELECT with a time-based delay (e.g., SLEEP).
7. The attacker parses the server's response to confirm successful injection or exfiltrate data from the database.

Impact

Successful exploitation of CVE-2024-2876 provides an unauthenticated attacker with the ability to perform full database extraction, modification, or destruction. Given the sensitive nature of email subscriber databases, this includes the theft of user lists, personal identifiers, and other stored content, impacting the privacy and integrity of the affected organization.

Recommendation

Prioritized actions for security teams:

• Update the Email Subscribers by Icegram Express plugin to version 5.7.15 or the latest available version immediately.
• Deploy the WAF rule below to identify and block exploit attempts targeting the advanced_filter parameter.
• Review web server access logs for anomalous POST requests to /wp-admin/admin-post.php containing SQL syntax characters (e.g., union, select, sleep).