CVE-2026-14554: The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privilege
The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-14554
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-145540.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-14554 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Check & Log
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- mediumCVE-2026-14231: The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of it…nvd · 2026-07-30
- highCVE-2026-14234: The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of …nvd · 2026-07-29
- lowCVE-2026-12690: The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its lic…nvd · 2026-07-24
- unknownCVE-2026-65760: Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure i…nvd · 2026-07-23
- mediumCVE-2026-48492: Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{ob…nvd · 2026-07-08
More from NVD Recent CVEs
- unknownCVE-2026-18556: Authentication bypass using an alternate path or channel vulnerability in N-able N-central all…2026-08-01
- unknownCVE-2026-55735: Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticat…2026-08-01
- unknownCVE-2026-55734: Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guar…2026-08-01
- unknownCVE-2026-55733: Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of se…2026-08-01
- unknownCVE-2026-54894: Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of se…2026-08-01