Newsletters Plugin CVE-2026-3018

Exploitation requires only that the target WordPress site has the Newsletters plugin (vendor contrid, also distributed as 'newsletters-lite') installed and activated at version 4.13 or earlier, with the endpoint that accepts the 'wpmlsubscriber_id' parameter reachable over the network - which is the default for subscriber management URLs. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no non-default configuration are required. The primary limiting factor is the presence of the vulnerable plugin itself; sites that do not run the Newsletters plugin or have already upgraded past the changeset 3566485 fix are not exploitable. A WAF in front of the site may block obvious SQLi payloads, raising attack complexity but not eliminating risk given the blind/time-based nature of the flaw.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact but no integrity or availability impact - consistent with read-only data exfiltration via blind SQLi. Exploitation status is no public exploit identified at time of analysis, and the CVE is not on the CISA KEV list. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Time-based blind SQLi is well within the capabilities of automated tooling (e.g., sqlmap), and WordPress plugin SQLi vulnerabilities historically attract opportunistic mass-scanning, so real-world risk should be treated as elevated despite the absence of a confirmed POC. The C:H rating is realistic given that WordPress databases typically hold password hashes, session tokens in wp_usermeta, API keys, and subscriber PII.

An unauthenticated attacker sends crafted HTTP requests to a WordPress endpoint exposed by the Newsletters plugin, supplying a 'wpmlsubscriber_id' parameter containing time-delay SQL payloads (e.g., AND SLEEP(5)) and measuring response latency to infer database contents bit by bit. Using an automated tool such as sqlmap, the attacker progressively extracts the wp_users table to recover administrator password hashes and subscriber email addresses for downstream cracking, credential stuffing, or sale. No public exploit identified at time of analysis, but time-based SQLi against documented parameters is trivially automatable.