{"id":"CVE-2026-14554","aliases":["EUVD-2026-51410","GHSA-wjfc-ffhr-q953"],"status":"published","title":"Check \u0026 Log Email \u003c 2.0.15 - Admin+ SQL Injection via d and s Parameters","description":"The Check \u0026 Log Email  WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.01411,"percentile":0.72892,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-07-31T06:00:06Z","modified":"2026-08-26T16:31:36Z","exploits":[{"source":"nuclei","id":"CVE-2026-14554","title":"WordPress Check \u0026 Log Email \u003c 2.0.15 - SQL Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-14554.yaml"}],"products":[{"vendor":"unknown","product":"check \u0026 log email"}],"references":[{"url":"https://wpscan.com/vulnerability/7b39bae3-41a2-4862-b7c3-1a386273d600/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14554"},{"url":"https://wpscan.com/vulnerability/7b39bae3-41a2-4862-b7c3-1a386273d600"},{"url":"https://github.com/advisories/GHSA-wjfc-ffhr-q953"}],"sources":{"cve":[{"id":"CVE-2026-14554","title":"Check \u0026 Log Email \u003c 2.0.15 - Admin+ SQL Injection via d and s Parameters","description":"The Check \u0026 Log Email  WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.","status":"published","published":"2026-07-31T06:00:06.278Z","modified":"2026-07-31T19:34:55.21Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:38:32.13011Z"}],"euvd":[{"id":"EUVD-2026-51410","description":"The Check \u0026 Log Email  WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.","status":"published","published":"2026-07-31T06:00:06Z","modified":"2026-07-31T19:34:55Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:25.159179Z"}],"ghsa":[{"id":"GHSA-wjfc-ffhr-q953","title":"The Check \u0026 Log Email  WordPress plugin before 2.0.15 does not properly sanitize and escape...","description":"The Check \u0026 Log Email  WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.","status":"published","published":"2026-07-31T09:31:17Z","modified":"2026-07-31T21:31:54Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:10:00.950607Z"}],"nvd":[{"id":"CVE-2026-14554","description":"The Check \u0026 Log Email  WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.","status":"published","published":"2026-07-31T07:16:24.987Z","modified":"2026-08-26T16:31:36.75Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:34.290716Z"}]}}