CVE-2024-4295 Scanner

The Email Subscribers plugin by Icegram Express is a popular WordPress tool used by site owners, marketers, and eCommerce platforms to manage newsletters, automate campaigns, and engage with subscribers. It handles large email lists and integrates easily into websites, making it accessible even to non-technical users. This plugin is essential for businesses that rely on email marketing to drive customer retention and sales.

CVE-2024-4295 is a critical SQL injection vulnerability that arises from improper sanitization of user-supplied input. The flaw occurs when the plugin processes subscription opt-in requests, specifically through the hash parameter. Attackers can inject malicious SQL commands into this parameter, bypassing authentication and directly manipulating the database.

The vulnerable endpoint is triggered during the subscription confirmation process, where the hash parameter is passed in the request. Due to insufficient input validation, attackers can append SQL statements to the hash value, causing the database to execute unintended queries. This allows extraction of sensitive data such as user credentials, email lists, and other stored information.

If exploited, an unauthenticated attacker can gain full read access to the WordPress database, potentially compromising all user data, including passwords and personal details. This can lead to account takeover, data breaches, and reputational damage. The high CVSS score of 9.8 underscores the severity and ease of exploitation.