Mail Mage Plugin SQL Injection via Unsanitized User Input

The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Mail Mage WordPress plugin through version 0.0.25 contains a critical SQL injection vulnerability (CWE-89) that allows unauthenticated attackers to execute arbitrary SQL queries against the affected WordPress database. This vulnerability exists because the plugin fails to properly sanitize and escape user-supplied input before incorporating it into SQL statements. WordPress sites running this plugin are immediately at risk, as attackers require no authentication to exploit this flaw. The impact is severe—attackers can extract sensitive data, modify database records, create backdoor accounts, or completely compromise the integrity of the WordPress installation and any data it manages.

Casky's platform maps this vulnerability to MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance), with 323 security skills available to detect exploitation patterns. Using Claude AI with extended reasoning, Casky identifies attack signatures such as malformed SQL syntax patterns in HTTP requests, unusual database query structures in access logs, and reconnaissance attempts probing plugin endpoints for version information. Practitioners reviewing findings would see detected patterns like SQL keywords (UNION, SELECT, WHERE) embedded in form parameters, timing-based blind SQL injection indicators, and failed query attempts that reveal database structure—all hallmarks of TA0001 exploitation attempts preceding full compromise, or TA0043 activities as attackers map the database schema before launching attacks.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-110532.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-110532

Casky has 323 skills that investigate the attack patterns behind CVE-2026-110532. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn