The Email Subscribers & Newsletters plugin for WordPress by Icegram contains an SQL Injection vulnerability (CVE-2024-4295) due to improper neutralization of special elements in the 'hash' parameter. This vulnerability affects all versions up to 5.7.20 and allows unauthenticated remote attackers to append arbitrary SQL queries to existing database queries. This occurs because user input is not sufficiently escaped or prepared before being included in SQL commands, leading to potential unauthorized data disclosure and modification. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 9.8, reflecting critical impact on confidentiality, integrity, and availability without requiring privileges or user interaction.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information stored in the WordPress database, modification or deletion of data, and potential full compromise of the affected site’s data integrity and availability. Since the attack vector is network-based and requires no authentication, the risk is significant for any site running the vulnerable plugin versions. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the vulnerable plugin to prevent exploitation. Monitor the vendor’s communications for updates on patches or official mitigations. Avoid exposing the affected WordPress installation to untrusted networks if possible.