EUVD-2026-93045
GHSA-jmm7-jg22-c3c6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public subscription form endpoint
-
ExploitInject SQL via form parameter
-
ExecutionDatabase executes attacker query
-
ImpactExtract sensitive WordPress data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the affected 'Newsletter Subscription Form - User Subscriptions Form, Capture Email' plugin (version 1.5.9 or earlier) by Weblizar be installed and active on a WordPress site, with its subscription/capture-email form endpoint reachable - typically the default state once the plugin is deployed on a public site. Per the CVSS vector (PR:N/UI:N), exploitation is unauthenticated and needs no victim interaction, so there is no meaningful access-level limiting factor; the primary constraint on real-world exposure is simply whether this specific, relatively uncommon plugin is installed. Upgrading past 1.5.9 removes the exposure. |
| Impact | This is a genuinely high-priority flaw by its technical profile but with limited corroborating exploitation signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction - the worst-case prerequisites for a web vulnerability, and consistent with a CWE-89 SQL injection reachable through a public subscription form. The 9.3 base score is driven heavily by the scope change (S:C) combined with C:H, though the input scores I:N and A:L, which is unusual for SQLi (injection typically threatens integrity as well); this suggests the Patchstack scoring was conservative about write/modify capability. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no evidence of active or at-scale exploitation - exploitation status is 'no public exploit identified at time of analysis.' Net assessment: the vulnerability class and unauthenticated vector make it a real patch priority for anyone running the affected plugin, but absent EPSS/KEV/POC data the current real-world exploitation likelihood is unquantified rather than confirmed-active. Note the C:H/I:N/A:L impact split is atypical for SQL injection and should be verified against the Patchstack advisory, as many SQLi flaws also permit data modification. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a crafted request to the plugin's newsletter/subscription form endpoint, injecting SQL into a parameter that is concatenated into a database query. Because no authentication or user interaction is required, the attacker can automate extraction of WordPress database contents such as user records and password hashes. No public exploit code was identified in the provided data, but the low attack complexity makes weaponization straightforward for a skilled attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated SQL injection in the Weblizar WordPress plugin 'Newsletter Subscription Form - User Subscriptions Form, Capture Email' (versions up to and including 1.5.9) lets an attacker who can reach the plugin's public subscription/capture-email form endpoint inject SQL through user-supplied input. Per the CVSS vector (PR:N/UI:N), no authentication or victim interaction is required, so any site running this plugin with a publicly reachable form is exposed; the primary limit on real-world exposure is simply whether this relatively uncommon plugin is installed. The feed score is 9.3, while our independent assessment scores it 8.1 (scope unchanged, confidentiality high, integrity low, availability none) because the demonstrated impact is primarily database read-out rather than full compromise. No public exploit code and no confirmed active exploitation (no CISA KEV entry) were identified at time of analysis, so this is a high-severity but not yet corroborated-as-exploited issue.
RemediationAI
The primary action is to update the 'Newsletter Subscription Form - User Subscriptions Form, Capture Email' plugin to a release above 1.5.9 (i.e., the first patched version published by Weblizar), since upgrading past 1.5.9 removes the exposure; the exact patched version number is not specified in the provided references, so confirm the fixed release in the plugin's changelog or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/newsletter-subscription-form/vulnerability/wordpress-newsletter-subscription-form-user-subscriptions-form-capture-email-plugin-1-5-9-sql-injection-vulnerability?_s_id=cve before assuming a given build is clean. No vendor-released patch identifier is confirmed in the supplied data, so if no fixed version is yet available, the most effective compensating control is to deactivate and delete the plugin - the trade-off is loss of subscriber/email capture functionality and possible orphaned shortcodes or stored form data. If the plugin must remain live, restrict external access to its subscription endpoint (for example, block direct POSTs to the plugin's PHP files and admin-ajax.php actions at the reverse proxy or WAF, allowing only the expected form fields and content types); this reduces the attack surface but can break legitimate anonymous subscribers and is bypassable if the WAF does not normalize obfuscated SQL payloads. Additional hardening that does not fully compensate: run the site's database user with least privilege (no FILE, no cross-schema access) to limit what a successful injection can read, and monitor database and web logs for anomalous query patterns or unusual parameters hitting the subscription form.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, improper neutralization of special elements used in an SQL command, in the subscription-handling code of a WordPress plugin. WordPress plugins of this type typically accept subscriber data (for example, an email address or other form field) via an unauthenticated entry point such as admin-ajax.php, a REST route, or a direct POST to a plugin PHP file, then pass that value into a database query. Where the value is concatenated or interpolated into the SQL string instead of being bound through $wpdb->prepare(), an attacker can append SQL syntax and alter the query. Because the CVSS vector carries PR:N and UI:N, the endpoint is reachable without any account on the site and without tricking a logged-in user, which is typical of front-end newsletter capture forms that must work for anonymous visitors. The CPE string from the input (cpe:2.3:a:weblizar_-_wordpress_themes_&_plugin:newsletter_subscription_form_-_user_subscriptions_form,_capture_email:*:*:*:*:*:*:*:*) uses a wildcard version and an unusually formatted vendor field, so it does not itself pin the affected release; the version constraint comes from the advisory title, which names 1.5.9 as the affected ceiling. With the database being the target, the practical consequence is extraction of data reachable through the vulnerable query, potentially including subscription records and, depending on query construction and database privileges, adjacent WordPress tables such as users, options, and other plugin data. Our independent assessment keeps scope unchanged and integrity low, so this should be treated as a serious information-disclosure/database-read flaw rather than an assumed remote code execution or full site takeover.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network-reachable form (AV:N/AC:L/PR:N/UI:N); SQLi enables full DB read (C:H) and some write (I:L); I treat it as same-scope (S:N), unlike the input's S:C.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in Newsletter Subscription Form - User Subscriptions Form, Capture Email <= 1.5.9 versions.
Executive ViewAI
Any WordPress site running the Weblizar 'Newsletter Subscription Form - User Subscriptions Form, Capture Email' plugin (versions through 1.5.9) exposes its database to an unauthenticated attacker who can reach the public subscription form - no login, account, or victim action is required. The demonstrated impact is disclosure of stored data, which in practice means subscriber email lists and any other database-resident information on those sites, carrying both privacy and regulatory exposure. Because this is an uncommon plugin, organizational exposure is likely limited to a small number of marketing or campaign sites, making a rapid inventory the fastest way to determine whether we are affected at all; the vulnerability is high severity but has not been corroborated as actively exploited, so this is a time-boxed containment problem rather than an emergency incident.
No vendor-released patch identified at time of analysis; interim mitigations are to deactivate or remove the affected plugin (versions 1.5.9 and earlier) from all WordPress sites, or where it cannot be removed, restrict public access to the subscription/capture-email endpoint via edge controls or IP allowlisting, apply WAF/virtual-patching rules for SQL injection against that endpoint, and monitor database and web logs for suspicious query activity. No public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) entry was identified.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB