Medium severity · published Jul 31, 2026
CVE-2026-14554
Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CL
Check & Log Email ·
before 2.0.15 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14554
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14554
wpscan.com
https://wpscan.com/vulnerability/7b39bae3-41a2-4862-b7c3-1a386273d600/
More from Check & Log Email
6.1
CVE-2022-1547
Check & Log email < 1.0.6 - Reflected Cross-Site Scripting
5.4
CVE-2026-5306
Check & Log Email < 2.0.13 - Unauthenticated Stored XSS