CVE-2026-15951 describes an SQL Injection vulnerability in the Icegram Mailer plugin for WordPress, specifically in versions <=1.0.12. The vulnerability exists because the get_logs() function in Icegram_Mailer_Logs_Table uses the 'fields' parameter from user input ($_REQUEST['data']) directly in the SELECT clause of an SQL query via implode(), without any whitelist validation, escaping, or prepared statement placeholders. This allows authenticated users with Administrator privileges to inject additional SQL queries, potentially leading to unauthorized disclosure of sensitive database information.

An attacker with Administrator-level access can exploit this vulnerability to perform SQL Injection attacks, enabling them to extract sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality. The CVSS 3.1 base score is 4.9 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

No official patch or remediation guidance has been published by the vendor as of now. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict Administrator-level access to trusted users only and consider disabling or removing the plugin if possible to mitigate risk.