Vulnerability · Published Jul 31, 2026 · Assigned by WPScan
CVE-2026-14554Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters
Medium 6.5
In plain English
A medium-severity SQL injection in Check & Log Email from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.4%top 27.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Check & Log Email | 0 – before 2.0.15 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
References
- https://wpscan.com/vulnerability/7b39bae3-41a2-4862-b7c3-1a386273d600/ exploit, vdb-entry, technical-description