{"id":"CVE-2026-110532","kind":"vulnerability","aliases":["CVE-2026-110532"],"related":[],"title":"Mail Mage WordPress plugin: unauthenticated SQL injection exposes site database","description":"The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.","summary":"The Mail Mage WordPress plugin through 0.0.25 passes a user-supplied value into a SQL statement without sanitising or escaping it. An unauthenticated attacker can run arbitrary SQL against the site database, which can expose or alter stored data.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mail-mage","fixed":[],"affected":"<= 0.0.25","ecosystem":"wordpress"}],"ecosystems":[],"tags":["mail-mage","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Run 'wp plugin list' or open the Plugins screen and look for Mail Mage (slug mail-mage) at 0.0.25 or earlier. Every released version is in range.","fix":"No fixed version exists. WordPress.org lists 0.0.25 as the latest release and says the plugin was closed on October 14, 2026 pending a full review, so it can't be downloaded. Deactivate and delete the plugin.","status":"open","published_at":"2026-11-06T06:16:39+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","triaged_at":"2026-11-06T06:42:04+00:00","updated_at":"2026-11-06T06:44:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T06:42:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Mail Mage WordPress plugin: unauthenticated SQL injection exposes site database","impact":"high","summary":"The Mail Mage WordPress plugin through 0.0.25 passes a user-supplied value into a SQL statement without sanitising or escaping it. An unauthenticated attacker can run arbitrary SQL against the site database, which can expose or alter stored data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mail-mage","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker reads or modifies the entire site database","analyst_note":"Find the vulnerable endpoint and whether a fixed plugin version exists, from the NVD entry or the plugin's changelog.","how_to_check":"- Check whether the `Mail Mage` plugin is installed and its version is `0.0.25` or earlier in the WordPress plugins screen or `wp plugin list`\n- unknown for other checks; the sources do not say which endpoint or parameter is affected","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Mail Mage WordPress plugin at version 0.0.25 or earlier are exposed, since the flaw is reachable without logging in. The sources do not name the vulnerable endpoint or any configuration that is required, so treat any site with the plugin installed as in scope. Sites without the plugin are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000709,"input_tokens":4197,"output_tokens":578,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the vulnerable endpoint and whether a fixed plugin version exists, from the NVD entry or the plugin's changelog.","search":"'-110532':13A,16A '-2026':12A,15A '0.0.25':34B,74C 'allow':93C 'alter':65B 'arbitrari':55B 'attack':52B,95C,100C 'cve':11A,14A 'data':67B 'databas':10A,60B 'escap':48B,80C 'expos':8A,63B 'host':26B 'inject':7A,99C 'mage':2A,19A,22B,30B,70C 'mail':1A,18A,21B,29B,69C 'mail-mag':20B 'mail-mage':17A 'packag':23B 'pass':35B 'perform':97C 'plugin':4A,32B,72C 'proper':77C 'run':54B 'sanitis':46B,78C 'self':25B 'self-host':24B 'site':9A,59B 'sql':6A,43B,56B,91C,98C 'statement':44B,92C 'store':66B 'suppli':39B,84C 'unauthent':5A,51B,94C 'use':87C 'user':38B,83C 'user-suppli':37B,82C 'valu':40B,85C 'without':45B 'wordpress':3A,27B,31B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Mail Mage WordPress plugin at version 0.0.25 or earlier are exposed, since the flaw is reachable without logging in. The sources do not name the vulnerable endpoint or any configuration that is required, so treat any site with the plugin installed as in scope. Sites without the plugin are not affected.","tier":"B","verified":{"fix":{"at":"2026-11-06T06:44:14Z","by":"analyst","doc":"https://nvd.nist.gov/vuln/detail/CVE-2026-110532","run_id":1867}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["mailmage"],"ptokens":["mage","mail"],"labels":["critical","mailmage","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-110532':13A,16A '-2026':12A,15A 'cve':11A,14A 'databas':10A 'expos':8A 'inject':7A 'mage':2A,19A 'mail':1A,18A 'mail-mage':17A 'plugin':4A 'site':9A 'sql':6A 'unauthent':5A 'wordpress':3A","search_b":"'0.0.25':34B 'alter':65B 'arbitrari':55B 'attack':52B 'data':67B 'databas':60B 'escap':48B 'expos':63B 'host':26B 'mage':22B,30B 'mail':21B,29B 'mail-mag':20B 'packag':23B 'pass':35B 'plugin':32B 'run':54B 'sanitis':46B 'self':25B 'self-host':24B 'site':59B 'sql':43B,56B 'statement':44B 'store':66B 'suppli':39B 'unauthent':51B 'user':38B 'user-suppli':37B 'valu':40B 'without':45B 'wordpress':27B,31B","search_c":"'0.0.25':74C 'allow':93C 'attack':95C,100C 'escap':80C 'inject':99C 'mage':70C 'mail':69C 'perform':97C 'plugin':72C 'proper':77C 'sanitis':78C 'sql':91C,98C 'statement':92C 'suppli':84C 'unauthent':94C 'use':87C 'user':83C 'user-suppli':82C 'valu':85C 'wordpress':71C","first_public_at":"2026-11-06T06:16:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110532","severity":null,"published_at":"2026-11-06T06:16:39+00:00","modified_at":"2026-11-06T06:16:39+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","fetched_at":"2026-11-06T06:40:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110532:1867","url":"https://wordpress.org/plugins/mail-mage/","severity":null,"published_at":"2026-11-06T06:44:14+00:00","modified_at":"2026-11-06T06:44:14+00:00","first_seen_at":"2026-11-06T06:44:14+00:00","fetched_at":"2026-11-06T06:44:14+00:00","note":"NVD says SQLi through 0.0.25. The WordPress.org page shows 0.0.25 as latest and the plugin closed 2026-10-14 (temporary, pending review). The vulnerable endpoint is not named in the sources I read. No exploitation or PoC found. Fix and how_to_check verified against the WordPress.org page.","cites":["https://wordpress.org/plugins/mail-mage/","https://nvd.nist.gov/vuln/detail/CVE-2026-110532"]}],"documents":[{"id":84166,"url":"https://wordpress.org/plugins/mail-mage/","title":"Mail Mage – WordPress.org plugin page (closed)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":84167,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110532","title":"NVD CVE-2026-110532","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}