CVE-2026-15951 describes an SQL Injection vulnerability in the Icegram Mailer plugin for WordPress, specifically in the Icegram_Mailer_Logs_Table::get_logs() function. The 'fields' parameter, received from $_REQUEST['data'], is an array whose elements are joined directly into the SELECT clause of an SQL query without any whitelist filtering, escaping, or prepared statement placeholders. This improper neutralization of special elements in SQL commands (CWE-89) enables authenticated users with Administrator privileges to append arbitrary SQL code to existing queries, potentially extracting sensitive data from the database. No official patch or remediation level has been published yet.

An attacker with Administrator-level access can exploit this vulnerability to perform SQL Injection attacks, allowing them to extract sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure (no integrity or availability impact is indicated). The attack vector is network-based with low attack complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only. Monitor for updates from the vendor regarding patches or official mitigations. Avoid exposing the affected plugin to untrusted administrators or users.