The Icegram Engage WordPress plugin is vulnerable to a second-order SQL Injection through the 'messages[][id]' parameter. The flaw arises because the plugin insufficiently escapes user input and fails to prepare SQL queries properly. An attacker with contributor-level or higher privileges can inject SQL via the save_campaign_preview() AJAX action, which stores the malicious input in post meta. Later, when get_message_data() executes, it interpolates this stored value directly into a SQL IN() clause without using $wpdb->prepare() or integer casting, enabling unauthorized data extraction from the database.

An attacker with contributor-level or higher access can exploit this vulnerability to extract sensitive information from the database by injecting additional SQL queries. The vulnerability does not allow privilege escalation or denial of service but compromises data confidentiality. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access and above to trusted users only. Monitor for updates from the vendor and apply patches promptly once released.