CVE-2026-101325
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Newsletters plugin for WordPress in versions up to and including 4.18.1 is vulnerable to time-based SQL Injection via the 'id' parameter due to insufficient escaping of user-supplied input and lack of proper preparation of the existing SQL query. An authenticated attacker with subscriber-level access or higher can append additional SQL queries to existing queries to extract sensitive information from the database. An attacker can obtain the required nonce and subscriberauth cookie without a WordPress account by subscribing through the public newsletter form and opening the management link sent via email; the ownership check verifies only the subscriber_id field and does not validate that the injected id parameter belongs to the authenticated subscriber.
Risk Assessment
SQL injection can allow extraction of database data, including user data and credentials, leading to a serious security breach. The vulnerability is accessible to low-privileged attackers, even without a WordPress account.
Recommendation
Update the Newsletters plugin to a version later than 4.18.1. Until updated, consider disabling the plugin or restricting subscription features.
Other vulnerabilities in Newsletters
See all- CVE-2026-94075Critical
The WordPress plugin Newsletters (newsletters-lite) up to version 4.18.1 contains a deserialization of untrusted data vulnerability, allowing object injection. This could enable an attacker to execute unintended code.
- CVE-2026-111402Critical
The WordPress plugin Newsletters (newsletters-lite) up to version 4.18.1 is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. This could allow an attacker to execute arbitrary SQL queries.
- CVE-2026-66619High
The WordPress plugin Newsletters in versions up to 4.18 contains an SQL Injection vulnerability accessible to users with administrator privileges. An administrator can inject malicious SQL queries through a vulnerable parameter.
- CVE-2026-17522Medium
The Newsletters WordPress plugin before version 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options. This allows attackers to make a logged-in administrator overwrite arbitrary plugin settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.
- CVE-2026-17520Medium
The Newsletters WordPress plugin before version 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value. This allows unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails, when the optional API has been enabled.
- CVE-2026-75908Medium
The Newsletters plugin for WordPress up to version 4.17 is vulnerable to authorization bypass. Authenticated attackers with author-level access and above can send arbitrary newsletter emails to users of any WordPress role, including administrators, by forging POST fields during a normal post submission. The attacker can supply a role slug via the newsletters_mailinglistsroles POST field, enabling unauthorized mass-mailing and potential phishing.
- CVE-2026-16269Medium
The Newsletters WordPress plugin before version 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled.
- CVE-2026-16267High
The Newsletters WordPress plugin before version 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.
- CVE-2026-57394High
The Newsletters plugin for WordPress (versions up to 4.14) is vulnerable to reflected XSS. Improper input neutralization during web page generation allows injection of malicious scripts.
- CVE-2026-3018High
The Newsletters plugin for WordPress up to version 4.13 is vulnerable to time-based SQL injection via the 'wpmlsubscriber_id' parameter. Insufficient escaping and lack of proper SQL query preparation allow unauthenticated attackers to append additional SQL queries, potentially extracting sensitive information from the database.
Original NVD description (English source)
The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 4.18.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An attacker can obtain the required nonce and subscriberauth cookie without a WordPress account by simply subscribing through the public newsletter form and opening the management link sent via email; the ownership check verifies only the subscriber_id field and does not validate that the injected id parameter belongs to the authenticated subscriber.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS