Description
WordPress Plugin email-subscribers 是一个用于管理电子邮件订阅的插件。该漏洞是由于插件在处理用户输入时未能正确过滤和验证，导致攻击者可以通过构造恶意的SQL语句，执行SQL注入攻击。成功利用此漏洞可能导致数据库信息泄露、数据篡改或进一步的系统入侵。
WordPress Plugin email-subscribers /wp-admin/admin-post.php advanced_filter SQL 注入漏洞（CVE-2024-2876）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-2876
https://www.wordfence.com/threat-intel/vulnerabilities/id/e0ca6ac4-0d89-4601-94fc-cce5a0af9c56
https://plugins.trac.wordpress.org/changeset/3060251/email-subscribers/trunk/lite/includes/classes/class-ig-es-subscriber-query.php
https://www.ionix.io/threat-center/cve-2024-2876/
https://vdp.patchstack.com/database/wordpress/plugin/email-subscribers/vulnerability/wordpress-icegram-express-plugin-5-7-14-unauthenticated-sql-injection-vulnerability
https://www.sentinelone.com/vulnerability-database/cve-2024-2876/
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2876.yaml
https://purely.website/insights/vulnerability-email-subscribers/
https://www.malcare.com/blog/icegram-express-sql-injection-vulnerability/