CVE-2024-2876
published 2024-05-02CVE-2024-2876: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL…
PriorityP189critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
80.60%
99.6th percentile
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IG_ES_Subscribers_Query' class in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Detection & IOCsextracted from sources · hover to see the quote
commandpage=es_subscribers&is_ajax=1&action=_sent&advanced_filter[conditions][0][0][field]=status=99924)))union(select(sleep(4)))--+&advanced_filter[conditions][0][0][operator]==&advanced_filter[conditions][0][0][value]=1111↗
- →Exploit targets POST /wp-admin/admin-post.php with Content-Type application/x-www-form-urlencoded; look for the 'page=es_subscribers' and 'is_ajax=1' parameters combined with SQL injection payloads in 'advanced_filter[conditions]' fields. ↗
- →Time-based blind SQLi detection: a response duration >= 4 seconds combined with HTTP 200, Content-Type application/json, and body containing 'bulk_action', '_sent', and 'errortype' indicates successful exploitation. ↗
- →Vulnerability is unauthenticated and exploitable via the 'run' function of the 'IG_ES_Subscribers_Query' class; no authentication required to trigger SQL injection. ↗
- →Active exploitation campaign observed: attackers leverage CVE-2024-2876 to create administrator accounts on vulnerable WordPress sites running Email Subscribers plugin versions 5.7.14 and older. ↗
- ·The Nuclei template uses a 20-second timeout (@timeout: 20s) to accommodate the time-based sleep(4) payload; detection rules should account for this extended response window to avoid false negatives. ↗
- ·All versions up to and including 5.7.14 of the Email Subscribers by Icegram Express plugin are affected; the plugin has approximately 90,000 active installations. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w55j-5hxw-v35j: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to
ghsa_unreviewed·2024-05-02
CVE-2024-2876 [CRITICAL] CWE-89 GHSA-w55j-5hxw-v35j: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IG_ES_Subscribers_Query' class in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
VulnCheck
Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin 'IG_ES_Subscribers_Query' Class SQL Injection
vulncheck·2024·CVSS 9.8
CVE-2024-2876 [CRITICAL] Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin 'IG_ES_Subscribers_Query' Class SQL Injection
Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin 'IG_ES_Subscribers_Query' Class SQL Injection
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IG_ES_Subscribers_Query' class in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected: icegram email_subscribers_\&_newsletters
Required Action: Apply remediations or mi
No detection rules found.
Nuclei
Wordpress Email Subscribers by Icegram Express - SQL Injection
nuclei·CVSS 9.8
CVE-2024-2876 [CRITICAL] Wordpress Email Subscribers by Icegram Express - SQL Injection
Wordpress Email Subscribers by Icegram Express - SQL Injection
The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IG_ES_Subscribers_Query' class in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Template:
id: CVE-2024-2876
info:
name: Wordpress Email Subscribers by Icegram Express - SQL Injection
author: iamnoooob,rootxharsh,pdresearch
severity: cr
Bleepingcomputer
Hackers exploit LiteSpeed Cache flaw to create WordPress admins
blogs_bleepingcomputer·2024-05-07·CVSS 8.3
[HIGH] Hackers exploit LiteSpeed Cache flaw to create WordPress admins
## Hackers exploit LiteSpeed Cache flaw to create WordPress admins
## Bill Toulas
Hackers have been targeting WordPress sites with an outdated version of the LiteSpeed Cache plugin to create administrator users and gain control of the websites.
LiteSpeed Cache (LS Cache) is advertised as a caching plugin used in over five million WordPress sites that helps speed up page loads, improve visitor experience, and boost Google Search ranking.
Automattic's security team, WPScan , observed in April increased activity from threat actors scanning for and compromising WordPress sites with versions of the plugin older than 5.7.0.1, which are vulnerable to a high-severity (8.8) unauthenticated cross-site scripting flaw tracked as CVE-2023-40000.
From one IP address, 94[.]102[.]51[.]144, there were
Greynoiseio
NoiseLetter October 2025
blogs_greynoiseio
NoiseLetter October 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
https://github.com/WordpressPluginDirectory/email-subscribers/blob/main/email-subscribers/lite/admin/class-email-subscribers-admin.php#L1433https://github.com/WordpressPluginDirectory/email-subscribers/blob/main/email-subscribers/lite/includes/classes/class-ig-es-subscriber-query.php#L304https://plugins.trac.wordpress.org/changeset/3060251/email-subscribers/trunk/lite/includes/classes/class-ig-es-subscriber-query.phphttps://www.wordfence.com/threat-intel/vulnerabilities/id/e0ca6ac4-0d89-4601-94fc-cce5a0af9c56?source=cvehttps://github.com/WordpressPluginDirectory/email-subscribers/blob/main/email-subscribers/lite/admin/class-email-subscribers-admin.php#L1433https://github.com/WordpressPluginDirectory/email-subscribers/blob/main/email-subscribers/lite/includes/classes/class-ig-es-subscriber-query.php#L304https://plugins.trac.wordpress.org/changeset/3060251/email-subscribers/trunk/lite/includes/classes/class-ig-es-subscriber-query.phphttps://www.wordfence.com/threat-intel/vulnerabilities/id/e0ca6ac4-0d89-4601-94fc-cce5a0af9c56?source=cve
2024-05-02
Published
Exploited in the wild