CVE-2024-2876

🗓️ 02 May 2024 16:52:46Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 149 Views🌐 WEB

The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection in versions up to 5.7.1

Reporter	Title	Published	Views	Family All 22
GithubExploit	Exploit for CVE-2024-2876	14 Sep 202416:08	–	githubexploit
GithubExploit	Exploit for CVE-2024-2876	9 Oct 202419:24	–	githubexploit
GithubExploit	Exploit for CVE-2024-2876	9 Oct 202419:24	–	githubexploit
Circl	CVE-2024-2876	25 Apr 202406:28	–	circl
CNNVD	WordPress Plugin email-subscribers SQL注入漏洞	2 May 202400:00	–	cnnvd
Cvelist	CVE-2024-2876 Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection	2 May 202416:52	–	cvelist
Nuclei	Wordpress Email Subscribers by Icegram Express - SQL Injection	4 Jun 202603:48	–	nuclei
NVD	CVE-2024-2876	2 May 202417:15	–	nvd
Packet Storm	📄 WordPress Email Subscribers 5.7.14 SQL Injection	2 Mar 202600:00	–	packetstorm
Packet Storm News	WordPress Email Subscribers by Icegram Express 5.7.14 SQL Injection	21 Jan 202500:00	–	packetstormnews

Vulners

Node

icegram email_subscribers_&_newsletters_email_marketing,_post_notifications_&_newsletter_plugin_for_wordpressRange≤5.7.14wordpress

[
  {
    "vendor": "icegram",
    "product": "Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.7.14",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e0ca6ac4-0d89-4601-94fc-cce5a0af9c56
github	www.github.com/WordpressPluginDirectory/email-subscribers/blob/main/email-subscribers/lite/admin/class-email-subscribers-admin.php
plugins	www.plugins.trac.wordpress.org/changeset/3060251/email-subscribers/trunk/lite/includes/classes/class-ig-es-subscriber-query.php
github	www.github.com/WordpressPluginDirectory/email-subscribers/blob/main/email-subscribers/lite/includes/classes/class-ig-es-subscriber-query.php

Parameter	Position	Path	Description	CWE
advanced_filter[conditions][0][0][field]	request body	wp-admin/admin-post.php	SQL Injection via unsafely constructed query in Email Subscribers plugin (CVE-2024-2876)	CWE-89
advanced_filter[conditions][0][0][operator]	request body	wp-admin/admin-post.php	SQL Injection via unsafely constructed query in Email Subscribers plugin (CVE-2024-2876)	CWE-89
advanced_filter[conditions][0][0][value]	request body	wp-admin/admin-post.php	SQL Injection via unsafely constructed query in Email Subscribers plugin (CVE-2024-2876)	CWE-89

15 Apr 2026 00:35Current

9.4High risk

Vulners AI Score9.4

CVSS 3.19.8

EPSS0.90916

SSVC

CWE-89