Time-Based SQL Injection Vulnerability in Newsletters Plugin for WordPress

CVE-2026-101325

What is CVE-2026-101325?

The Newsletters plugin for WordPress exposes a time-based SQL Injection vulnerability due to inadequate escaping of user-supplied parameters in the 'id' field. This issue affects all versions up to and including 4.18.1. It enables authenticated attackers, possessing subscriber-level access or higher, to inject malicious SQL queries. An attacker can manipulate the SQL request and potentially extract sensitive data from the database. Furthermore, by simply subscribing through the public newsletter form and utilizing the management link provided in email communications, an attacker can bypass ownership checks and exploit this vulnerability without requiring a WordPress account.

References