CVE-2026-16087

Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter

View on CVE.org
Published Aug 1, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is second-order: the malicious id value is first persisted to post meta via the save_campaign_preview() AJAX action (gated by a nonce check and edit_post capability, requiring Editor-level access or above), and only executed as SQL when a subsequent preview request triggers get_message_data() to interpolate the stored value directly into a SQL IN() clause without $wpdb->prepare() or integer casting.

Analysis

AI-generated

Technical impact

The Icegram Engage plugin for WordPress contains a second-order SQL injection flaw that allows an attacker who has at least contributor privileges to store a crafted message ID value. When a later preview request retrieves this value, it is directly interpolated into a SQL IN() clause without proper escaping or parameterization, enabling the attacker to append malicious SQL and extract sensitive database information.

Affected Systems

All WordPress sites running Icegram Engage version 3.1.42 or earlier are vulnerable. The flaw exists within the plugin’s campaign preview functionality and the associated AJAX handlers, specifically the save_campaign_preview() and get_message_data() functions.

Risk and Exploitability

The flaw carries a CVSS score of 6.5, indicating moderate severity. The EPSS score is below 1 %, implying a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate with contributor‑level or higher access, save a malicious payload via the AJAX action protected by a nonce, and then trigger a preview request to activate the injection. Successful exploitation could lead to unauthorized data extraction from the WordPress database.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Icegram Engage to a version newer than 3.1.42, or apply the vendor’s official patch if available.
  • If an update cannot be applied immediately, reduce the privileges of contributors or temporarily revoke editor-level access until the vulnerability is fixed.
  • Review the plugin configuration to ensure that any stored message IDs are cast to integers or passed through $wpdb->prepare() before being used in SQL queries; if the code is not modifiable, consider disabling the preview feature until a patch is available.
  • Conduct a database audit for unexpected data or malicious queries that may indicate an exploitation attempt.

Generated by OpenCVE AI on August 2, 2026 at 03:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Icegram
Icegram icegram Engage – Popups, Optins, Ctas & Lead Generation
Wordpress
Wordpress wordpress
Vendors & Products Icegram
Icegram icegram Engage – Popups, Optins, Ctas & Lead Generation
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is second-order: the malicious id value is first persisted to post meta via the save_campaign_preview() AJAX action (gated by a nonce check and edit_post capability, requiring Editor-level access or above), and only executed as SQL when a subsequent preview request triggers get_message_data() to interpolate the stored value directly into a SQL IN() clause without $wpdb->prepare() or integer casting.
Title Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Aug 3, 2026, 3:38 PM
Reserved
Jul 17, 2026, 1:53 PM

View source JSON

Updated
Aug 3, 2026, 1:45 PM

JSON

Status
Deferred
Published
Aug 1, 2026, 9:17 AM
Modified
Aug 12, 2026, 9:00 PM

View source JSON

No data.

Updated
Aug 2, 2026, 8:32 PM

JSON