Email Subscribers by Icegram Express CVE-2024-2876: Unauthenticated SQL Injection (CVSS 9.8)

If you run email newsletters or marketing automations on your WordPress site, there is a good chance you have used Email Subscribers by Icegram Express. It is one of the most widely deployed newsletter plugins in the WordPress ecosystem, powering subscriber lists and automated campaigns on tens of thousands of sites. In early 2024, security researchers disclosed a critical flaw in it, tracked as CVE-2024-2876, that let unauthenticated attackers pull data straight out of the site database. With a CVSS score of 9.8, this is about as serious as WordPress vulnerabilities get, and it required no login, no user account, and no special access to exploit.

This post walks through what the vulnerability is, how it works in plain language, what it could do to a real site, and exactly how to check whether you are exposed and fix it.

CVE-2024-2876 at a glance

• CVE ID: CVE-2024-2876
• Plugin: Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
• Vulnerability type: Unauthenticated SQL Injection
• CVSS 3.1 score: 9.8 (Critical) — vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Affected versions: All versions up to and including 5.7.14
• Patched version: 5.7.15 (update to the latest release)
• Public disclosure: May 2, 2024
• Discovered by: Arkadiusz Hydzik, reported through the Wordfence bug bounty program

The CVSS vector tells the whole story at a glance: attackable over the network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction needed (UI:N), and high impact on confidentiality, integrity, and availability. In short, anyone on the internet could reach it and the potential damage was severe.

How the vulnerability works

SQL injection is one of the oldest and most damaging classes of web vulnerability. Every WordPress site stores its content, users, and settings in a database, and the site talks to that database using SQL queries. When a plugin builds those queries by gluing together user-supplied input without properly cleaning or “preparing” it first, an attacker can smuggle their own SQL commands into the query. The database cannot tell the difference between the plugin’s intended instructions and the attacker’s injected ones, so it runs both.

In Email Subscribers by Icegram Express, the flaw lived in the run() function of the IG_ES_Subscribers_Query class. This code handles queries against the plugin’s subscriber data. Because a user-supplied parameter was not escaped properly and the query was not sufficiently prepared, an attacker could append their own SQL to the existing query. Crucially, this code path was reachable without authentication. An attacker did not need to register, log in, or hold any role on the site. They simply had to send a crafted request.

The end result is what security researchers call a data extraction primitive: the attacker manipulates the query so the database returns information it was never meant to expose. This is typically done with UNION-based or blind injection techniques, coaxing the database into handing over the contents of other tables one piece at a time.

Real-world impact

Because the injection reaches the full WordPress database, the consequences go well beyond the newsletter plugin’s own data. On a typical site, an attacker exploiting this flaw could potentially extract:

• Subscriber lists and email addresses stored by the plugin — a privacy breach and a ready-made target list for phishing or spam.
• WordPress user records from the wp_users table, including usernames and hashed passwords, which can be cracked offline.
• Password reset keys and session tokens, which in some scenarios can be abused to hijack accounts, including administrator accounts.
• Secret keys and configuration values stored in the options table, which can open the door to deeper compromise.

Once an attacker has administrator credentials or a valid session, a data-disclosure bug quickly escalates into full site takeover: installing malicious plugins, planting web shells, redirecting visitors, or defacing the site. For sites subject to privacy regulations such as GDPR, a leak of subscriber email addresses is also a reportable data breach with legal and reputational costs. It is worth noting that this vulnerability carried a high EPSS score, an industry estimate of the likelihood of exploitation, which reflects how attractive unauthenticated SQL injection flaws are to attackers scanning the web at scale.

How to check if you are affected

You are affected if your site runs Email Subscribers by Icegram Express at version 5.7.14 or earlier. Here is how to confirm:

1. Log in to your WordPress dashboard and go to Plugins > Installed Plugins.
2. Look for “Email Subscribers & Newsletters” or “Icegram Express” in the list.
3. Check the version number shown beneath the plugin name. If it reads 5.7.14 or lower, your site is vulnerable and needs updating immediately.
4. If you are not sure whether the plugin is active, you can also check the /wp-content/plugins/email-subscribers/ directory on your server for its presence.

Because this flaw is exploitable without any login, do not assume you are safe just because you have strong passwords or limited user accounts. The only factors that matter here are whether the plugin is installed and which version you are running.

How to fix it

The fix is straightforward: update the plugin to version 5.7.15 or later, where the developers corrected the query handling so user input is properly escaped and prepared. Newer releases are available and recommended.

1. In your dashboard, go to Dashboard > Updates or Plugins > Installed Plugins and apply the available update for Email Subscribers by Icegram Express.
2. Before updating a production site, take a full backup of your files and database so you can roll back if anything goes wrong.
3. After updating, confirm the version now reads 5.7.15 or higher.
4. If you cannot update right away, deactivate and remove the plugin until you can. An inactive plugin still on disk can remain a risk, so removal is safer than deactivation alone.

A few additional hardening steps reduce your exposure to this class of bug in the future:

• Enable automatic updates for plugins where you can, so security fixes land without waiting on manual intervention.
• Run a web application firewall (WAF) that can block common SQL injection patterns and virtually patch known CVEs before you update.
• Review your database user privileges so the WordPress account only has the permissions it genuinely needs.
• Monitor logs and file changes for signs of exploitation, such as unusual query strings hitting plugin endpoints or unexpected new admin users.
• If you believe your site was exploited before patching, treat it as a potential breach: rotate passwords and secret keys, force a re-login of all users, and audit for unauthorized accounts or files.

The takeaway

CVE-2024-2876 is a textbook reminder that a single unescaped parameter in a popular plugin can put your entire database within reach of anonymous attackers. The plugin itself is legitimate and useful; the lesson is not to avoid such tools but to keep them updated and to build defense in depth around them. Update Email Subscribers by Icegram Express to 5.7.15 or later today, keep automatic updates on where practical, back your site up regularly, and put a firewall in front of your site. Those habits turn the next critical plugin CVE from an emergency into a non-event.