$ cve CVE-2024-2876 JSON

CVE-2024-2876

9.8

CRITICAL · CVSS 3.1 · EPSS 80.6% (pctl 100)

Patch early

EPSS 80.6% — above the 10% action threshold.

Description

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IG_ES_Subscribers_Query' class in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	80.6% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-89
On CISA KEV	no
Public exploit	none known
Published	2024-05-02
Last modified	2026-06-17

References

→ the Explorer · watch your stack · NVD