CVE-2026-2831 is an SQL Injection vulnerability in the MailArchiver plugin for WordPress affecting all versions up to 4.5.0. The issue arises from insufficient escaping and lack of proper preparation of the 'logid' parameter in SQL queries. Authenticated attackers with Administrator privileges can exploit this to append arbitrary SQL queries, potentially extracting sensitive data from the database. The vulnerability has a CVSS 3.1 base score of 4.9, with network attack vector, low attack complexity, high privileges required, no user interaction, and impact primarily on confidentiality.

Successful exploitation allows an authenticated administrator to extract sensitive information from the database by injecting additional SQL commands. There is no indication of impact on data integrity or availability. The vulnerability does not appear to be actively exploited in the wild based on current data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for unusual database queries related to the 'logid' parameter. Avoid exposing this plugin on publicly accessible environments without additional protective controls.