SQL Injection Vulnerability in EnvíaloSimple Email Marketing Plugin for WordPress

CVE-2026-7618

What is CVE-2026-7618?

The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is susceptible to time-based blind SQL Injection via the 'orderby' parameter. This vulnerability arises from inadequate escaping of user-supplied input and insufficient preparation of SQL queries. Authenticated users with administrator-level access can exploit this flaw to insert additional SQL commands into existing queries, potentially exposing sensitive information from the database. It is essential for users to update to the latest version to mitigate this risk.

References