Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The MailArchiver plugin for WordPress is vulnerable to SQL Injection via the ‘logid’ parameter in all versions up to, and including, 4.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-27 | 2 | Disclosure2 |
| 2026-06-08 | 1 | Active Exploitation1 |
La CISA a signalée Vendredi des attaques ciblant la CVE-2026-2831, une vulnérabilité dans SolarWinds Serv-U qui a été corrigée deux jours plus tôt. Elle peut donner lieu à un déni de service (DoS) via des requêtes POST spécialement conçues. https://tinyurl.com/397rbttv
Post summary
CISA reported ongoing attacks exploiting SolarWinds Serv-U CVE-2026-2831, a DoS vulnerability that had just been patched.
CVE-2026-2831 The MailArchiver plugin for WordPress is vulnerable to SQL Injection via the ‘logid’ parameter in all versions up to, and including, 4.5.0 due to insufficient escaping … https://www.cve.org/CVERecord?id=CVE-2026-2831
Post summary
CVE-2026-2831 is an SQL injection vulnerability in the MailArchiver WordPress plugin's logid parameter affecting all versions up to 4.5.0 due to insufficient escaping.
CVE-2026-2831 SQL Injection in WordPress MailArchiver Plugin Versions 4.5.0 and Below https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2831
Post summary
The post announces a SQL injection vulnerability (CVE‑2026‑2831) in WordPress MailArchiver Plugin versions 4.5.0 and earlier.