Time-Based SQL Injection Vulnerability in Newsletters Plugin for WordPress

CVE-2025-3107

What is CVE-2025-3107?

The Newsletters plugin for WordPress is susceptible to a time-based SQL Injection attack through the 'orderby' parameter. This vulnerability arises from inadequate escaping of user-supplied input and a lack of sufficient preparation on the existing SQL query. Authenticated users with Contributor-level access or higher can exploit this weakness to insert their own SQL commands into existing queries, potentially allowing them to retrieve sensitive information from the database. It's crucial to apply security best practices to ensure database integrity and prevent unauthorized access.

References