The Icegram Engage plugin for WordPress suffers from a second-order SQL Injection vulnerability (CWE-89) in all versions up to 3.1.42. The issue occurs because the 'messages[][id]' parameter is insufficiently escaped and stored in post meta via the save_campaign_preview() AJAX action, which requires Editor-level or higher access. Later, when a preview request calls get_message_data(), the stored malicious id value is interpolated directly into a SQL IN() clause without using $wpdb->prepare() or integer casting, allowing an attacker to append additional SQL queries. This can lead to unauthorized extraction of sensitive information from the database. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required.

An authenticated attacker with contributor-level or higher privileges can exploit this vulnerability to perform second-order SQL Injection attacks. This can result in unauthorized disclosure of sensitive database information. The vulnerability does not impact integrity or availability directly but compromises confidentiality by allowing data extraction through crafted SQL queries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level and higher access to trusted users only. Monitor for updates from the vendor regarding patches or official fixes. Avoid using affected versions in sensitive environments if possible.