CVE-2026-16087

Name of the Vulnerable Software and Affected Versions Icegram Engage – Popups, Optins, CTAs & Lead Generation versions prior to 3.1.43

Description An issue exists where authenticated attackers with contributor-level access and above can perform a second-order SQL Injection. This occurs because the messages[][id] parameter is not sufficiently escaped and the resulting SQL query is not properly prepared. The attack process involves two steps: first, a malicious value is stored in post meta through the save campaign preview() AJAX action (which requires Editor-level access or above); second, the stored value is executed as SQL when a preview request triggers the get message data() function, which interpolates the value into a SQL IN() clause without using $wpdb->prepare() or integer casting. This allows attackers to append additional SQL queries to extract sensitive information from the database.

Recommendations Update to a version newer than 3.1.42. As a temporary workaround, restrict access to the save campaign preview() AJAX action and the get message data() function to only highly trusted administrators.