WordPress security changelog
MEDIUM CVE-2026-16087 Received

Icegram campaign previews execute stored SQL injection

Icegram Engage through 3.1.42 stores an attacker-controlled messages[][id] value in post meta through save_campaign_preview(), which requires a valid nonce and edit_post capability and therefore Editor access in the disclosed path. A later preview makes get_message_data() interpolate the stored value into an SQL IN clause without preparation or integer casting, enabling database extraction.

CVE / CNA score 6.5 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Icegram Engage – Popups, Optins, CTAs & Lead Generation
Plugin slug
icegram
Affected
<= 3.1.42
Safe version
> 3.1.42
Published
Aug 01, 2026
Weakness
CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

This CVE was published Aug 01, 2026 and is one of 14 known issues for this plugin.

What to do

Update, patch or deactivate.

Update to a corrected release after 3.1.42. Review campaign-preview metadata and database logs for SQL payloads, remove malicious IDs, and rotate secrets if database disclosure is suspected.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is second-order: the malicious id value is first persisted to post meta via the save_campaign_preview() AJAX action (gated by a nonce check and edit_post capability, requiring Editor-level access or above), and only executed as SQL when a subsequent preview request triggers get_message_data() to interpolate the stored value directly into a SQL IN() clause without $wpdb->prepare() or integer casting.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Primary and upstream sources