What’s Vulnerable › Vulnerabilities

CVE-2021-24758: Email Log < 2.4.7 - Admin+ SQL Injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-17 · updated 2026-06-17
• Weakness: CWE-89

Description

The Email Log WordPress plugin before 2.4.7 does not properly validate, sanitise and escape the "orderby" and "order" GET parameters before using them in SQL statement in the admin dashboard, leading to SQL injections

Affected products

• Email Log: before 2.4.7 — fixed in 2.4.7

How to fix

Upgrade to a fixed version: Email Log 2.4.7. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/8dd70db4-5845-440d-8b1d-012738abaac2
• https://wpscan.com/vulnerability/8dd70db4-5845-440d-8b1d-012738abaac2

Get alerted when CVE-2021-24758 or the next vulnerability affects your stack