The vulnerability in the Icegram Mailer WordPress plugin allows attackers with Administrator access to inject arbitrary SQL via the 'fields' parameter. The plugin mistakenly concatenates user‑supplied values into the SELECT clause without sanitization or whitelisting. This can lead to data exfiltration from the WordPress database. The weakness is a classic unchecked SQL injection (CWE-89).

WordPress installations running Icegram Mailer version 1.0.12 or earlier are affected. The vulnerability exists in the Icegram_Mailer_Logs_Table::get_logs() routine handling the 'fields' request data. Systems using the plugin before the patch are at risk.

The CVSS base score of 4.9 indicates moderate risk, and the EPSS score of less than 1% signals that current exploitation activity is low. The flaw requires an authenticated user with Administrator or higher privileges, so only site owners or privileged contributors can exploit it. Because the issue is not yet listed in KEV, there is no evidence of public tooling, but the lack of input validation makes the attack straightforward for users who can send crafted requests to the plugin’s logs endpoint.