CVE-2026-1651: 
WordPress vulnerability analysis and mitigation

CVE-2026-1651 is an authenticated SQL injection vulnerability in the Email Subscribers by Icegram Express plugin for WordPress, affecting all versions up to and including 5.9.16. The flaw exists in the workflow_ids parameter of the update_status() function, allowing attackers with administrator-level access to append malicious SQL queries and extract sensitive data from the database. It was discovered on January 28, 2026, reported to Wordfence the same day, and publicly disclosed on March 4, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, though the original researcher's advisory assigned it 7.2 (High) (Wordfence, ENISA EUVD).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). In the file lite/includes/workflows/db/class-es-db-workflows.php, the update_status() function applies esc_sql() to the workflow_ids array, which only escapes quotes and backslashes — insufficient protection for numeric values used in an SQL IN clause. String interpolation of $workflow_ids_str occurs before $wpdb->prepare() is called, meaning attacker-controlled values are embedded directly into the query. The vulnerability is reachable via the WordPress AJAX endpoint (wp_ajax_icegram-express) with the handler=workflows and method=update_status parameters, requiring only a valid administrator session (GitHub Gist, WordPress Trac).

Successful exploitation allows an authenticated administrator to extract sensitive information from the WordPress database, including user password hashes, email addresses, plugin configuration data, and other secrets. The vulnerability also permits modification of database contents via crafted UPDATE statements. The researcher noted that if combined with a separate Broken Access Control vulnerability in the same plugin, lower-privileged users could potentially reach this endpoint, amplifying the risk beyond administrator-only access (GitHub Gist, Wordfence).

A public proof-of-concept (PoC) JavaScript script demonstrating boolean-based blind and time-based SQL injection is available on GitHub, capable of extracting the WordPress administrator's password hash character by character. No evidence of active in-the-wild exploitation or threat actor attribution has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.027% (0.000270), indicating a low probability of exploitation in the near term (GitHub Gist, Wordfence).

1. Authentication: Log in to the WordPress admin panel with an administrator account on a site running Email Subscribers by Icegram Express version 5.9.15 or earlier.
2. Navigate to plugin page: Go to any Email Subscribers admin page (e.g., /wp-admin/admin.php?page=es_workflows) to ensure the plugin's JavaScript variables (including ig_es_js_data.security nonce) are loaded.
3. Open browser console: Open browser Developer Tools (F12) and navigate to the Console tab.
4. Inject SQL payload via AJAX: Send a crafted POST request to the wp_ajax_icegram-express AJAX endpoint with handler=workflows, method=update_status, and a malicious workflow_ids value such as 1) AND IF(<condition>,SLEEP(0.5),0)-- -.
5. Extract data via blind injection: Use the public PoC script to perform binary-search boolean-based blind SQL injection, iterating over character positions of the target value (e.g., SELECT user_pass FROM wp_users WHERE ID=1) and inferring each character based on server response timing.
6. Crack or use extracted hash: Collect the extracted WordPress PHPass password hash and attempt offline cracking (e.g., with Hashcat) or use it for further privilege escalation (GitHub Gist).

• Network: Repeated POST requests to /wp-admin/admin-ajax.php with parameters action=icegram-express, handler=workflows, method=update_status, and workflow_ids values containing SQL syntax (e.g., parentheses, AND IF, SLEEP, SUBSTRING, ASCII).
• Logs: WordPress or web server access logs showing high-frequency AJAX requests to admin-ajax.php from a single authenticated session, particularly with unusual or long data POST body values; slow query logs in MySQL/MariaDB showing time-delayed queries involving ig_workflows table.
• Database: Unexpected or anomalous UPDATE statements on the wp_ig_workflows table; evidence of SELECT queries against wp_users table originating from plugin context.
• Process: Database server showing elevated query execution times consistent with SLEEP()-based injection attempts.

Users should update the Email Subscribers by Icegram Express plugin to version 5.9.17 or later, as the vulnerability was patched in the changeset available on the WordPress plugin repository. The fix involves replacing the insufficient esc_sql() sanitization with proper use of $wpdb->prepare() with parameterized placeholders for the workflow_ids values. As an interim measure, administrators can restrict access to the WordPress admin panel via IP allowlisting and disable unused AJAX endpoints. Monitoring for anomalous AJAX requests to admin-ajax.php is also recommended (WordPress Trac Changeset, Wordfence).

Sucuri included CVE-2026-1651 in their March 2026 vulnerability patch roundup, highlighting it as a notable WordPress plugin flaw requiring prompt patching (Sucuri Blog). The vulnerability was also noted by INCIBE-CERT in Spain's early warning system and received standard coverage across vulnerability aggregators. No significant controversy or broader community debate has been observed beyond routine disclosure.