Newsletters Plugin CVE-2026-101325

Requires a running, reachable installation of the Newsletters (newsletters-lite) plugin at version ≤4.18.1 with its public subscription workflow enabled. The attacker does NOT need a WordPress account: per the description they subscribe via the public newsletter form, open the management link emailed to them, and thereby obtain a valid nonce and subscriberauth cookie; the ownership check only verifies subscriber_id and never validates that the injected 'id' parameter belongs to the authenticated subscriber. The main limiting factors are that the attacker must complete this subscribe-and-confirm email flow to get a token, and that extraction is time-based blind SQL injection, which is slow and request-intensive rather than a single-shot dump.

Raw severity is moderate (CVSS 5.3, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N): network-reachable, confidentiality-only impact, with the vendor vector marking high attack complexity and low-privilege access. No EPSS score, CISA KEV listing, or POC/exploit reference was supplied, so exploitation signals are weak on paper and this is not an emergency-tier item - the vuln.today decision label is 'this_month', consistent with a prioritize-but-not-drop-everything issue. However, the PR:L metric understates practical exposure: the description states an attacker needs no WordPress account at all, because the required nonce and subscriberauth cookie can be obtained by anyone who subscribes through the public newsletter form and opens the emailed management link, and the ownership check validates only subscriber_id while ignoring the injected 'id' parameter. That tension between PR:L / AC:H (implying a meaningful barrier) and a description implying near-unauthenticated, straightforward token acquisition pushes the real-world risk somewhat above what the 5.3 suggests - verify the effort of token acquisition against the vendor advisory. Mitigating factors: the flaw yields only time-based blind data extraction (C:H, I:N, A:N), which is slow and noisy, and exploitation is limited to installations of this specific plugin.

An attacker with no WordPress account subscribes through the target site's public newsletter form, receives the management link by email, and harvests the valid nonce and subscriberauth cookie. Using that token they send requests manipulating the 'id' parameter, which is insufficiently escaped and unprepared, to inject time-based blind SQL and extract sensitive database contents (e.g., user data or password hashes) one conditional query at a time. No public exploit code was identified in the supplied data, so an attacker would need to script the blind extraction themselves.