The MailArchiver plugin for WordPress contains an SQL injection flaw in the ‘logid’ parameter. The code fails to escape user-supplied input, allowing an attacker to inject arbitrary SQL into the existing query. When an attacker with Administrator or higher privileges crafts a malicious value for logid, they can retrieve sensitive data from the database, potentially exposing personally identifiable information or asset‑level details. The weakness is a classic instance of OWASP CWE‑89, where unsanitized input is concatenated directly into a SQL statement.

The vulnerability exists in all MailArchiver releases up to and including version 4.5.0. The affected product is the WordPress MailArchiver plugin developed by pierrelannoy. Any installation of MailArchiver <=4.5.0 that is active on a WordPress site is potentially exposed.

The CVSS score of 4.9 reflects a moderate severity, with an EPSS of less than 1%, indicating a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit requires authenticated access at the Administrator level or higher and manipulation of the logid parameter, which can typically be supplied as a query string in an HTTP request. An attacker who is able to activate the plugin and supply a crafted logid value can extract database contents, and potentially pivot to further compromise if additional privileges are available.