SQL Injection (CVE-2024-2876) #shorts #breaking

CVE

Today, we're talking about an urgent cybersecurity issue, specifically a new SQL Injection vulnerability found in the WordPress plugin 'Email Subscribers by Icegram Express'. This issue, known as CVE-2024-2876, is particularly severe because it's a zero-day vulnerability, meaning it was unknown before its first appearance, which is today. This issue affects over 90,000 websites using the vulnerable plugin. Hackers exploiting this vulnerability can potentially extract sensitive information from the website's database. If you're using 'Email Subscribers by Icegram Express', and your version is up to 5.7.14, you're at risk. Immediate action is required: update your plugin as soon as the developers release a fix to protect your website and your data.

Watch the full video on YouTube: CVE-2024-2876

Remediation and exploitation details

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

CVE database technical details

CVE ID

CVE-2024-2876

Description

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IG_ES_Subscribers_Query' class in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Provider

Wordfence

CWE / problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Software Versions

icegram:Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce:[{'version': '*', 'status': 'affected', 'lessThanOrEqual': '5.7.14', 'versionType': 'semver'}]

Date Published

2024-05-02T16:52:46.382Z

Last Updated

2024-08-01T19:25:42.164Z