CVE-2024-2876

🗓️ 02 May 2024 16:52:46Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 278 Views🌐 WEB

The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection in versions up to 5.7.1

Reporter	Title	Published	Views	Family All 30
GithubExploit	Exploit for CVE-2024-2876	25 Apr 202409:53	–	githubexploit
GithubExploit	Exploit for CVE-2024-2876	14 Sep 202416:08	–	githubexploit
GithubExploit	Exploit for CVE-2024-2876	9 Oct 202419:24	–	githubexploit
GithubExploit	Exploit for CVE-2024-2876	9 Oct 202419:24	–	githubexploit
Circl	CVE-2024-2876	25 Apr 202406:28	–	circl
CNNVD	WordPress Plugin email-subscribers SQL注入漏洞	2 May 202400:00	–	cnnvd
Cvelist	CVE-2024-2876 Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection	2 May 202416:52	–	cvelist
Kitploit	CVE-2024-2876	9 Oct 202619:30	–	kitploit
Kitploit	CVE-2024-2876	11 Oct 202623:00	–	kitploit
Kitploit	CVE-2024-2876	7 Oct 202602:08	–	kitploit

Vulners

Node

icegram email_subscribers_&_newslettersRange≤5.7.14wordpress

[
  {
    "vendor": "icegram",
    "product": "Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.7.14",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e0ca6ac4-0d89-4601-94fc-cce5a0af9c56
plugins	www.plugins.trac.wordpress.org/changeset/3060251/email-subscribers/trunk/lite/includes/classes/class-ig-es-subscriber-query.php
github	www.github.com/WordpressPluginDirectory/email-subscribers/blob/main/email-subscribers/lite/admin/class-email-subscribers-admin.php
github	www.github.com/WordpressPluginDirectory/email-subscribers/blob/main/email-subscribers/lite/includes/classes/class-ig-es-subscriber-query.php

Parameter	Position	Path	Description	CWE
advanced_filter[conditions][0][0][field]	request body	/wp-admin/admin-post.php	SQL Injection vulnerability in WordPress Email Subscribers plugin via unsafely processed advanced_filter field in admin-post AJAX action (CVE-2024-2876, CWE-89).	CWE-89

17 Jun 2026 07:25Current

9.4Critical risk

Vulners AI Score9.4

CVSS 3.19.8

EPSS0.80596

SSVC