CVE-2026-110532: Mail Mage <= 0.0.25 - Unauthenticated SQLi via 'ewp_unsubscribe' Parameter

Q: Who can exploit this issue?

The issue can be exploited by unauthenticated attackers; no WordPress account or plugin-level authentication is required.

Q: What input is involved in the vulnerable request?

The SQL injection is associated with the user-supplied ewp_unsubscribe parameter, which is used in a SQL statement without proper sanitization and escaping.

Q: Which plugin versions are affected?

Mail Mage versions through 0.0.25 are affected.

Published Nov 6, 2026

Updated

The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

The issue can be exploited by unauthenticated attackers; no WordPress account or plugin-level authentication is required.

What input is involved in the vulnerable request?

The SQL injection is associated with the user-supplied ewp_unsubscribe parameter, which is used in a SQL statement without proper sanitization and escaping.

Which plugin versions are affected?

Mail Mage versions through 0.0.25 are affected.

CVE-2026-110532: Mail Mage <= 0.0.25 - Unauthenticated SQLi via 'ewp_unsubscribe' Parameter

Event History

Frequently Asked Questions

Who can exploit this issue?

What input is involved in the vulnerable request?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What input is involved in the vulnerable request?

Which plugin versions are affected?