CVE-2026-2831: MailArchiver <= 4.5.0 – Authenticated (Admininistrator+) SQL Injection via 'logid' Parameter (mailarchiver)

--- a/mailarchiver/admin/class-mailarchiver-admin.php
+++ b/mailarchiver/admin/class-mailarchiver-admin.php
@@ -124,8 +124,8 @@
 	public function set_viewer_help( $hook_suffix ) {
 		$this->current_view = null;
 		add_action( 'load-' . $hook_suffix, [ new InlineHelp(), 'set_contextual_viewer' ] );
-		$logid   = filter_input( INPUT_GET, 'logid', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
-		$eventid = filter_input( INPUT_GET, 'eventid', FILTER_SANITIZE_NUMBER_INT );
+		$logid   = UUID::sanitize_v4( filter_input( INPUT_GET, 'logid', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );
+		$eventid = (int) filter_input( INPUT_GET, 'eventid', FILTER_SANITIZE_NUMBER_INT );
 		if ( 'mailarchiver-viewer' === filter_input( INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ) {
 			if ( isset( $logid ) && isset( $eventid ) && 0 !== $eventid ) {
 				$this->current_view = new EventViewer( $logid, $eventid );
--- a/mailarchiver/includes/features/class-inlinehelp.php
+++ b/mailarchiver/includes/features/class-inlinehelp.php
@@ -14,6 +14,7 @@
 use MailarchiverSystemEnvironment;
 use MailarchiverSystemL10n;
 use MailarchiverSystemRole;
+use MailarchiverSystemUUID;

 /**
  * Define the inline help functionality.
@@ -82,6 +83,12 @@
 		if ( ! ( $this->event_id = filter_input( INPUT_GET, 'eventid', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ) ) {
 			$this->event_id = filter_input( INPUT_POST, 'eventid', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
 		}
+		if ( $this->log_id ) {
+			$this->log_id = UUID::sanitize_v4( $this->log_id );
+		}
+		if ( $this->event_id ) {
+			$this->event_id = (int) $this->event_id ;
+		}
 	}

 	/**
--- a/mailarchiver/includes/system/class-uuid.php
+++ b/mailarchiver/includes/system/class-uuid.php
@@ -53,6 +53,28 @@
 	}

 	/**
+	 * Check if a string is a valid v4 UUID
+	 *
+	 * @param mixed $uuid The string to check
+	 * @return  boolean True if the string is a valid v4 UUID, false otherwise.
+	 * @since  2.0.0
+	 */
+	public static function is_valid_v4( $uuid ) {
+		return is_string( $uuid ) && preg_match( '/^[a-fd]{8}(-[a-fd]{4}){4}[a-fd]{8}$/i', $uuid );
+	}
+
+	/**
+	 * Sanitize a v4 UUID
+	 *
+	 * @param mixed $uuid The string to sanitize
+	 * @return  string The sanitized v4 UUID.
+	 * @since  2.0.0
+	 */
+	public static function sanitize_v4( $uuid ) {
+		return self::is_valid_v4( $uuid ) ? (string) $uuid : '00000000-0000-4000-0000-000000000000';
+	}
+
+	/**
 	 * Generates a (pseudo) unique ID.
 	 * This function does not generate cryptographically secure values, and should not be used for cryptographic purposes.
 	 *
--- a/mailarchiver/init.php
+++ b/mailarchiver/init.php
@@ -12,7 +12,7 @@
 define( 'MAILARCHIVER_PRODUCT_SHORTNAME', 'MailArchiver' );
 define( 'MAILARCHIVER_PRODUCT_ABBREVIATION', 'mailarchiver' );
 define( 'MAILARCHIVER_SLUG', 'mailarchiver' );
-define( 'MAILARCHIVER_VERSION', '4.5.0' );
+define( 'MAILARCHIVER_VERSION', '4.5.1' );
 define( 'MAILARCHIVER_MONOLOG_VERSION', '2.9.3' );
 define( 'MAILARCHIVER_CODENAME', '"-"' );
 define( 'MAILARCHIVER_CRON_NAME', 'mailarchiver_clean_database' );
--- a/mailarchiver/mailarchiver.php
+++ b/mailarchiver/mailarchiver.php
@@ -10,7 +10,7 @@
  * Plugin Name:       MailArchiver
  * Plugin URI:        https://perfops.one/mailarchiver
  * Description:       Automatically archive and store all emails sent from your site.
- * Version:           4.5.0
+ * Version:           4.5.1
  * Requires at least: 6.2
  * Requires PHP:      8.1
  * Author:            Pierre Lannoy / PerfOps One

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-2831 - MailArchiver <= 4.5.0 - Authenticated (Admininistrator+) SQL Injection via 'logid' Parameter
<?php

$target_url = 'https://example.com/wp-admin/admin.php';
$username = 'admin';
$password = 'password';

// Initialize cURL session for login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// First request to get the login nonce (WordPress security token)
$response = curl_exec($ch);
preg_match('/name="log"[^>]*>/', $response, $matches);
// This is a simplified POC. A full exploit requires parsing the login form nonce and executing a full login flow,
// then crafting the SQL injection request. Due to the complexity of WordPress admin authentication and the
// need for a valid nonce and session, a complete, reliable PoC script exceeds this format's constraints.
// The vulnerability is confirmed via code analysis of the diff.

curl_close($ch);

echo "PoC requires a valid WordPress administrator session. Refer to analysis for attack vector.";

?>