EIP-2026-104497

PRE-CVE

WordPress Plugin Freshmail 1.5.8 - SQL Injection

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-104497. PoCs published by Felipe Molina.

AI-analyzed exploit summary This is a detailed technical writeup describing an unauthenticated SQL injection vulnerability in the WordPress Freshmail plugin (versions <= 1.5.8). The vulnerability exists in the `fm_form_id` POST parameter due to improper sanitization in `wp_ajax_fm_form.php`.

Description

WordPress Plugin Freshmail 1.5.8 - SQL Injection

Exploits (1)

exploitdb WRITEUP

by Felipe Molina · textwebappsmultiple

https://www.exploit-db.com/exploits/36930

View Code ZIP pw:eip

This is a detailed technical writeup describing an unauthenticated SQL injection vulnerability in the WordPress Freshmail plugin (versions <= 1.5.8). The vulnerability exists in the `fm_form_id` POST parameter due to improper sanitization in `wp_ajax_fm_form.php`.

Classification

Writeup 95%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: WordPress Freshmail plugin <= 1.5.8

No auth needed

Prerequisites: WordPress installation with Freshmail plugin <= 1.5.8 · PHP with magic_quotes_gpc turned off

MITRE ATT&CK

T1189 - Drive-by Compromise T1505 - Server Software Component

devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026