EUVD-2026-35997
GHSA-gfq4-fcqw-rmwq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, and including, 4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Articles & Coverage 1
AnalysisAI
Unauthenticated time-based SQL injection in the Newsletters plugin for WordPress (versions up to and including 4.13) allows remote attackers to extract sensitive database contents via the 'wpmlsubscriber_id' parameter. The flaw stems from insufficient input escaping and lack of prepared statements, and no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that the target WordPress site has the Newsletters plugin (vendor contrid, also distributed as 'newsletters-lite') installed and activated at version 4.13 or earlier, with the endpoint that accepts the 'wpmlsubscriber_id' parameter reachable over the network - which is the default for subscriber management URLs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact but no integrity or availability impact - consistent with read-only data exfiltration via blind SQLi. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends crafted HTTP requests to a WordPress endpoint exposed by the Newsletters plugin, supplying a 'wpmlsubscriber_id' parameter containing time-delay SQL payloads (e.g., AND SLEEP(5)) and measuring response latency to infer database contents bit by bit. Using an automated tool such as sqlmap, the attacker progressively extracts the wp_users table to recover administrator password hashes and subscriber email addresses for downstream cracking, credential stuffing, or sale. … |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - the fix is visible in WordPress.org plugin changeset 3566485 (https://plugins.trac.wordpress.org/changeset/3566485/newsletters-lite), so administrators should upgrade the Newsletters plugin to the latest version published after that changeset (any release greater than 4.13) via the WordPress admin dashboard. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Conduct inventory of all WordPress instances running Newsletters plugin versions 4.13 or earlier; identify and document affected systems and their business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that i
Remote code execution in UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions ≤1.26.4) allows unauthenticat
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline
Remote code execution in Edgar Rojas WooCommerce PDF Invoice Builder WordPress plugin (versions through 2.0.8) allows un
Share
External POC / Exploit Code
Leaving vuln.today