What is the CVSS score of EUVD-2026-32103?

EUVD-2026-32103 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

EnvíaloSimple Plugin EUVD-2026-32103

| CVE-2026-7618 MEDIUM

SQL Injection (CWE-89)

2026-05-27 security@wordfence.com

GHSA-g4mx-fxx5-fjm6

SQLi WordPress

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:19 vuln.today

CVE Published

May 27, 2026 - 08:16 nvd

MEDIUM 4.9

DescriptionCVE.org

The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Time-based blind SQL Injection in the EnvíaloSimple: Email Marketing y Newsletters WordPress plugin (all versions through 2.4.5) allows authenticated administrators to extract sensitive data from the underlying database. The vulnerability is in the 'orderby' parameter, which is insufficiently escaped and passed into existing SQL queries without adequate preparation, enabling an attacker with administrator-level WordPress credentials to append arbitrary SQL and enumerate database contents. EPSS is very low (0.03%, 8th percentile), no public exploit has been identified, and the vulnerability is not listed in CISA KEV, suggesting limited real-world exploitation pressure at this time.

Technical ContextAI

The vulnerability resides in the EnvíaloSimple WordPress plugin, specifically within the API layer - traced to contactform7.php (lines 113 and 117) and api/index.php (line 8) in version 2.4.5 of the plugin. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the root cause: user-supplied input to the 'orderby' parameter is not properly sanitized or parameterized before being appended to an existing SQL query. Because this is a time-based blind injection, the attacker cannot directly read query output; instead, the database is forced to delay responses conditionally, and data is extracted bit-by-bit by measuring response timing. This technique is stealthier than error-based or union-based SQLi but still fully capable of exfiltrating WordPress database contents, including user credentials, configuration data, and email subscriber lists stored by the plugin.

RemediationAI

No vendor-released patch version is identified in the provided data - the references point to the vulnerable 2.4.5 codebase and do not confirm a fixed release. Site administrators should consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a7aa2246-aee9-4992-b030-97e78e3b7d22 for the latest patch status and update the plugin to the most recent available version if one has been released. As an immediate compensating control, consider deactivating the EnvíaloSimple plugin until a fix is confirmed, particularly on sites where the WordPress administrator account is shared, weakly protected, or accessible to untrusted parties. Enforcing multi-factor authentication on all WordPress administrator accounts reduces the risk of an attacker reaching the privilege level required to trigger this vulnerability. Restricting administrator access by IP allowlist at the web server or WAF layer is a further compensating control; a WAF rule targeting SQL timing keywords in the 'orderby' parameter may provide partial coverage but should not be relied upon as a primary defense. Monitoring WordPress audit logs for unusual plugin API calls or unexpected slow queries may assist in detecting exploitation attempts.