CVE-2024-2876

What it actually does

This is an unauthenticated SQL injection vulnerability in the Email Subscribers by Icegram Express WordPress plugin in versions up to and including 5.7.14. The vulnerable IG_ES_Subscribers_Query::run path builds a database query using attacker-controlled input without sufficient escaping or parameterized preparation. A remote attacker can append or alter SQL executed by WordPress, allowing database reads and potentially database modification or destructive queries depending on database permissions and exploit technique. The CVSS score is critical, the attack requires no authentication or user interaction, and the high EPSS plus weaponized exploit maturity indicate a substantial likelihood of real-world exploitation.

Why it matters to the business

Successful exploitation can expose sensitive website data such as subscriber lists, email addresses, WordPress user records, password hashes, WooCommerce-related data if present in the same database, and other stored content. Attackers may also alter database records, create persistence, disrupt site operations, damage email marketing data integrity, or use stolen information for phishing and account takeover. Because this issue is remotely exploitable without login and has weaponized exploitation with a high EPSS score, internet-facing WordPress sites using affected plugin versions should be treated as high-priority remediation targets.

How an attack unfolds

An attacker first identifies WordPress sites running the Email Subscribers by Icegram Express plugin and determines whether the installed version is 5.7.14 or older. They then send a crafted HTTP request to plugin-exposed functionality that reaches the IG_ES_Subscribers_Query run logic. The request includes a malicious value in a parameter that is incorporated into an SQL statement without adequate escaping or prepared-statement binding. When WordPress processes the request, the database executes the attacker-influenced SQL, allowing the attacker to infer data through blind SQL injection, extract rows using union/error/time-based techniques where possible, or potentially modify database contents if stacked or write-oriented queries are viable in the target configuration. After confirming exploitation, the attacker may dump user and subscriber data, look for administrator accounts and password hashes, modify options or users for persistence, and use the compromised site or data for spam, phishing, or further intrusion.

How to fix it

Upgrade the Email Subscribers by Icegram Express plugin to a vendor-fixed release newer than 5.7.14; if exact package management data is unavailable, install the latest version from the official WordPress plugin repository or vendor distribution and verify the changelog confirms the SQL injection fix. If immediate upgrade is not possible, disable and remove the plugin until it can be safely updated. Restrict direct access to WordPress administrative and plugin endpoints where feasible, deploy web application firewall rules for SQL injection payloads, and ensure the WordPress database user has only the minimum privileges needed by the application. After remediation, rotate credentials if database compromise is suspected, review WordPress administrator accounts, invalidate active sessions, and consider resetting passwords for affected users if sensitive account data may have been accessed.

How to confirm the fix worked

Confirm the installed plugin version is greater than 5.7.14 from the WordPress admin plugin inventory, wp-cli, filesystem metadata, or the plugin readme/changelog. Verify that vulnerable copies are not present in backups, staging directories, containers, or alternate WordPress roots exposed to the internet. Review web server access logs for suspicious unauthenticated requests containing SQL injection syntax against WordPress or plugin paths. If safe and authorized, use a non-destructive vulnerability scanner or controlled proof-of-fix test to confirm SQL metacharacters are rejected, parameterized, or no longer influence query behavior. Validate that WAF rules are alerting on SQL injection attempts, and confirm database permissions do not allow unnecessary write, file, or administrative operations.

Typical attack path

1. Scan the internet for WordPress sites exposing the Email Subscribers by Icegram Express plugin, commonly under /wp-content/plugins/email-subscribers/.
2. Confirm or infer that the plugin version is 5.7.14 or older using plugin metadata, static assets, changelog/readme files, or behavioral probing.
3. Send crafted unauthenticated HTTP requests to plugin functionality that invokes IG_ES_Subscribers_Query::run with SQL metacharacters or encoded SQL payloads in user-controlled parameters.
4. Use boolean, error-based, union-based, or time-based SQL injection techniques to validate that the database query is attacker-controllable.
5. Enumerate database metadata such as table names and columns, then extract subscriber records, WordPress user data, password hashes, site configuration values, or other sensitive records.
6. If feasible, modify database contents to create persistence, change site settings, add users, inject malicious content, or disrupt application availability.
7. Cover tracks by limiting noisy requests, using common user agents, rotating source IPs, or blending SQL injection payloads into normal web traffic.

How to detect it

Investigate web server, CDN, reverse proxy, WAF, WordPress security plugin, PHP error, and database query logs for unauthenticated requests containing SQL injection syntax, especially requests involving WordPress endpoints and the Email Subscribers plugin path. Focus on the period since the vulnerability became public and on any spikes in 4xx/5xx responses, slow responses caused by time-delay payloads, or repeated parameter fuzzing from the same source. Look for attempts to enumerate database metadata, extract WordPress user records, dump subscriber data, or use time-based functions such as SLEEP and BENCHMARK. Check database logs for queries referencing information_schema, wp_users, wp_options, or plugin subscriber tables in unusual contexts. On the host, review WordPress administrator accounts, recently modified plugin/theme files, unexpected PHP files in upload directories, suspicious changes to wp_options, new scheduled tasks or cron entries, and unexplained subscriber exports. Because public reporting indicates weaponized exploitation, absence of a unique malware artifact does not rule out compromise; correlate payload evidence with database access, account changes, and file modification timelines.

• /wp-content/plugins/email-subscribers/
• IG_ES_Subscribers_Query
• UNION SELECT
• UNION%20SELECT
• information_schema
• information_schema.tables
• information_schema.columns
• SLEEP(
• SLEEP%28
• BENCHMARK(
• BENCHMARK%28
• updatexml(
• updatexml%28
• extractvalue(
• extractvalue%28
• LOAD_FILE(
• LOAD_FILE%28
• INTO OUTFILE
• INTO%20OUTFILE
• -- -
• #
• %23
• /*
• %2F%2A
• wp_users
• wp_options
• SELECT user_login
• SELECT%20user_login
• SELECT user_pass
• SELECT%20user_pass
• SELECT option_value
• SELECT%20option_value

What your security team should do

• Immediately inventory all WordPress installations for the Email Subscribers by Icegram Express plugin and prioritize any version 5.7.14 or older for urgent remediation.
• Upgrade affected installations to the latest vendor-fixed plugin release; if upgrade cannot be completed promptly, disable the plugin until remediation is available.
• Treat internet-facing vulnerable systems as potentially targeted because exploit maturity is weaponized and EPSS is high.
• Search historical web access logs, WAF logs, CDN logs, and database logs for SQL injection attempts targeting WordPress and plugin-related endpoints.
• Review database contents and WordPress accounts for unauthorized administrator users, changed options, injected posts/pages, modified plugin files, and unexpected subscriber exports.
• Reset WordPress administrator credentials and rotate database credentials if exploitation is suspected or confirmed.
• Add or tune WAF/SIEM detections for SQL injection patterns such as UNION SELECT, information_schema, SLEEP(), BENCHMARK(), updatexml(), extractvalue(), and SQL comment delimiters in WordPress request parameters.
• Harden WordPress operations by disabling public access to plugin readme/changelog files where possible, minimizing database privileges, enforcing MFA for administrators, and maintaining automated plugin update monitoring.