EIP-2026-104497

This is a detailed technical writeup describing an unauthenticated SQL injection vulnerability in the WordPress Freshmail plugin (versions <= 1.5.8). The vulnerability exists in the `fm_form_id` POST parameter due to improper sanitization in `wp_ajax_fm_form.php`.