CVE-2024-4295 is a Critical (CVSS 9.8) SQL injection in the Email Subscribers and Newsletters plugin by Icegram for WordPress, in versions up to and including 5.7.20. The hash parameter is the entry point and no login is needed. Update to a release newer than 5.7.20.
What's affected
- Product: Email Subscribers and Newsletters by Icegram Express, a WordPress plugin.
- Affected versions: all up to and including 5.7.20.
- Fixed version: not named in the record. It lists a Trac changeset (3090845) that touches the lists and contacts database class. Use the newest release.
- Severity: Critical, CVSS 9.8, unauthenticated and network reachable.
- Impact in the record: extraction of sensitive information from the database.
- Exploitation: KEV is false. I found no report of attacks.
How to check if you're exposed
Check the installed version on every WordPress site:
wp plugin get email-subscribers --field=version
Anything at or below 5.7.20 matches the record. Because the plugin stores subscriber lists, the data in play is email addresses and any custom fields you collect. Look at database and web logs for long requests that include the hash parameter with unusual content.
What to do now
- Run the version check on every WordPress install, including staging sites.
- Update the plugin to the latest release.
- Export or review the subscriber tables to understand what data an attacker could have read.
- Review web logs for odd requests with a hash parameter and slow database queries.
- If you suspect data was read, follow your breach notification process and consider rotating any secrets stored in the database.
Why it matters
The record maps this to CWE-89, SQL injection. The plugin builds a query using the hash value and does not prepare it, so the value can add its own SQL. The record's wording is that the escaping was insufficient and the query lacked preparation.
The usual fix is a prepared statement, where the query structure and the data travel separately. Because newsletter plugins have large installed bases and a public form style endpoint, flaws like this get scanned for quickly.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does exploitation require an account?
No. The record says unauthenticated attackers can use it.
What data is at risk?
The record says sensitive information from the database. For this plugin that includes subscriber data, and the WordPress database can hold more.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4295 (published 2024-06-05) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
