The WordPress plugin Email Subscribers & Newsletters by Icegram has an SQL injection flaw on the workflow_ids parameter that allows an authenticated user with administrator privileges to inject arbitrary SQL statements. The vulnerability is caused by insufficient escaping of that parameter and lack of proper query preparation, enabling attackers to read or discover sensitive data from the database. The weakness is classified as CWE-89 and can lead to compromise of confidentiality and integrity of stored data.

The flaw affects all releases of the plugin up to version 5.9.16. WordPress sites running any of these versions and using the plugin are susceptible. Administrators with full control over the site, or users with higher privileges, are required to exploit the issue.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. However, because it requires administrative authentication, the risk is limited to sites where attackers already have such access. If an attacker gains admin credentials or compromises a site through other means, they could exploit this flaw to extract data. The attack can be carried out by sending a specially crafted request to the workflow_ids parameter, bypassing the existing input filtering.