Description
The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is second-order: the malicious id value is first persisted to post meta via the save_campaign_preview() AJAX action (gated by a nonce check and edit_post capability, requiring Editor-level access or above), and only executed as SQL when a subsequent preview request triggers get_message_data() to interpolate the stored value directly into a SQL IN() clause without $wpdb->prepare() or integer casting.
Published: 2026-08-01
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Icegram Engage plugin for WordPress contains a second-order SQL injection flaw that allows an attacker who has at least contributor privileges to store a crafted message ID value. When a later preview request retrieves this value, it is directly interpolated into a SQL IN() clause without proper escaping or parameterization, enabling the attacker to append malicious SQL and extract sensitive database information.

Affected Systems

All WordPress sites running Icegram Engage version 3.1.42 or earlier are vulnerable. The flaw exists within the plugin’s campaign preview functionality and the associated AJAX handlers, specifically the save_campaign_preview() and get_message_data() functions.

Risk and Exploitability

The flaw carries a CVSS score of 6.5, indicating moderate severity. The EPSS score is below 1 %, implying a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate with contributor‑level or higher access, save a malicious payload via the AJAX action protected by a nonce, and then trigger a preview request to activate the injection. Successful exploitation could lead to unauthorized data extraction from the WordPress database.

Generated by OpenCVE AI on August 2, 2026 at 03:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Icegram Engage to a version newer than 3.1.42, or apply the vendor’s official patch if available.
  • If an update cannot be applied immediately, reduce the privileges of contributors or temporarily revoke editor-level access until the vulnerability is fixed.
  • Review the plugin configuration to ensure that any stored message IDs are cast to integers or passed through $wpdb->prepare() before being used in SQL queries; if the code is not modifiable, consider disabling the preview feature until a patch is available.
  • Conduct a database audit for unexpected data or malicious queries that may indicate an exploitation attempt.

Generated by OpenCVE AI on August 2, 2026 at 03:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 03 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 02 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Icegram
Icegram icegram Engage – Popups, Optins, Ctas & Lead Generation
Wordpress
Wordpress wordpress
Vendors & Products Icegram
Icegram icegram Engage – Popups, Optins, Ctas & Lead Generation
Wordpress
Wordpress wordpress

Sat, 01 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
Description The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is second-order: the malicious id value is first persisted to post meta via the save_campaign_preview() AJAX action (gated by a nonce check and edit_post capability, requiring Editor-level access or above), and only executed as SQL when a subsequent preview request triggers get_message_data() to interpolate the stored value directly into a SQL IN() clause without $wpdb->prepare() or integer casting.
Title Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Icegram Icegram Engage – Popups, Optins, Ctas & Lead Generation
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-03T15:38:46.412Z

Reserved: 2026-07-17T13:53:29.064Z

Link: CVE-2026-16087

cve-icon Vulnrichment

Updated: 2026-08-03T13:45:55.559Z

cve-icon NVD

Status : Deferred

Published: 2026-08-01T09:17:00.290

Modified: 2026-08-12T21:00:37.147

Link: CVE-2026-16087

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T20:32:02Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')