Newsletter Subscription Form User Subscriptions Form Capture Email
Monthly
Unauthenticated SQL injection in the Weblizar WordPress plugin 'Newsletter Subscription Form - User Subscriptions Form, Capture Email' (versions up to and including 1.5.9) lets an attacker who can reach the plugin's public subscription/capture-email form endpoint inject SQL through user-supplied input. Per the CVSS vector (PR:N/UI:N), no authentication or victim interaction is required, so any site running this plugin with a publicly reachable form is exposed; the primary limit on real-world exposure is simply whether this relatively uncommon plugin is installed. The feed score is 9.3, while our independent assessment scores it 8.1 (scope unchanged, confidentiality high, integrity low, availability none) because the demonstrated impact is primarily database read-out rather than full compromise. No public exploit code and no confirmed active exploitation (no CISA KEV entry) were identified at time of analysis, so this is a high-severity but not yet corroborated-as-exploited issue.
Unauthenticated SQL injection in the Weblizar WordPress plugin 'Newsletter Subscription Form - User Subscriptions Form, Capture Email' (versions up to and including 1.5.9) lets an attacker who can reach the plugin's public subscription/capture-email form endpoint inject SQL through user-supplied input. Per the CVSS vector (PR:N/UI:N), no authentication or victim interaction is required, so any site running this plugin with a publicly reachable form is exposed; the primary limit on real-world exposure is simply whether this relatively uncommon plugin is installed. The feed score is 9.3, while our independent assessment scores it 8.1 (scope unchanged, confidentiality high, integrity low, availability none) because the demonstrated impact is primarily database read-out rather than full compromise. No public exploit code and no confirmed active exploitation (no CISA KEV entry) were identified at time of analysis, so this is a high-severity but not yet corroborated-as-exploited issue.