What is the CVSS score of CVE-2026-3018?

CVE-2026-3018 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Newsletters Plugin are affected by CVE-2026-3018?

The Newsletters plugin for WordPress (versions up to 4.13) contains an unauthenticated SQL injection vulnerability enabling remote attackers to extract sensitive database contents without…

Is there a public PoC exploit available for CVE-2026-3018?

Yes, a public proof-of-concept exploit is available for CVE-2026-3018. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-3018?

24 hours: Conduct inventory of all WordPress instances running Newsletters plugin versions 4.13 or earlier; identify and document affected systems and their business criticality. 7 days: Implement interim compensating controls including Web Application Firewall rules to block suspicious 'wpmlsubscriber_id' parameters, restrict plugin access via network segmentation, and apply input validation measures. 30 days: Upgrade Newsletters plugin to the latest patched version or migrate to an alternative newsletter management platform if updates are unavailable.

Newsletters Plugin CVE-2026-3018

EUVD-2026-35997 HIGH

SQL Injection (CWE-89)

2026-06-10 Wordfence

GHSA-gfq4-fcqw-rmwq

WordPress SQLi Newsletters Wordpress Plugin Contrid

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 10:15 vuln.today

CVE Published

Jun 10, 2026 - 08:28 nvd

HIGH 7.5

DescriptionCVE.org

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, and including, 4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Articles & Coverage 1

News 5 New WordPress Vulnerabilities - 2 Critical, 3 With POC Jun 11, 2026

AnalysisAI

Unauthenticated time-based SQL injection in the Newsletters plugin for WordPress (versions up to and including 4.13) allows remote attackers to extract sensitive database contents via the 'wpmlsubscriber_id' parameter. The flaw stems from insufficient input escaping and lack of prepared statements, and no public exploit identified at time of analysis. The CVSS 7.5 score reflects confidentiality-only impact with no required authentication or user interaction.

Technical ContextAI

The vulnerability resides in the Newsletters plugin (vendor: contrid, per CPE cpe:2.3:a:contrid:newsletters), a WordPress extension used for managing email newsletter subscribers and campaigns. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically a time-based blind SQL injection where the 'wpmlsubscriber_id' parameter is concatenated into a SQL query without parameterized binding or sufficient escaping. The vulnerable code path is visible in wp-mailinglist-plugin.php around line 6040 (per the plugins.trac.wordpress.org reference). Time-based injection means an attacker infers data by measuring delays induced via SQL functions such as SLEEP() or BENCHMARK(), since the application does not return query results directly to the attacker.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - the fix is visible in WordPress.org plugin changeset 3566485 (https://plugins.trac.wordpress.org/changeset/3566485/newsletters-lite), so administrators should upgrade the Newsletters plugin to the latest version published after that changeset (any release greater than 4.13) via the WordPress admin dashboard. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8e2672b5-64a2-4b30-b0be-2a9303d46ac1?source=cve for the vendor-published guidance. If immediate patching is not possible, compensating controls include deploying a WAF rule (Wordfence, Cloudflare, or ModSecurity OWASP CRS) to block requests containing SQL syntax in the 'wpmlsubscriber_id' parameter - note this may produce false positives on legitimate numeric IDs that contain unexpected characters; temporarily deactivating the Newsletters plugin removes the attack surface entirely but disables newsletter subscription and unsubscribe flows; restricting access to the vulnerable endpoint via IP allow-listing at the web server or reverse proxy is feasible only if subscriber-facing URLs are not publicly required, which is rarely the case for newsletter signup pages.