Is CVE-2026-3018 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3018 being exploited in the wild.

How severe is CVE-2026-3018?

High severity, with a CVSS score of 7.5, published 10 June 2026.

Which products and versions are affected?

Tribulant Newsletters Up to and including 4.13.

Is there a fix for CVE-2026-3018?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-3018 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-3018?

Check whether you run Tribulant Newsletters at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3018: WordPress Newsletters plugin SQL injection in wpmlsubscriber_id

CVE-2026-3018 · Severity: high · CVSS 7.5 · Published 2026-06-10

The Newsletters plugin for WordPress, which manages email marketing and subscriber lists, contains a security flaw that allows unauthorized individuals to access private database information. By sending specially crafted requests, an attacker can bypass security measures to extract sensitive data such as user credentials or subscriber details. This could lead to a significant data breach and compromise the privacy of your mailing list subscribers.

Technologies: Tribulant Newsletters. Vendors: Tribulant.

Quick answers

Is CVE-2026-3018 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3018 being exploited in the wild.
How severe is CVE-2026-3018?: High severity, with a CVSS score of 7.5, published 10 June 2026.
Which products and versions are affected?: Tribulant Newsletters Up to and including 4.13.
Is there a fix for CVE-2026-3018?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-3018 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-3018?: Check whether you run Tribulant Newsletters at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A time-based SQL injection vulnerability exists in the Newsletters plugin for WordPress due to improper neutralization of the 'wpmlsubscriber_id' parameter. The root cause is a failure to use sufficient escaping and SQL query preparation (wpdb::prepare) when handling user-supplied input. An unauthenticated attacker can exploit this over the network by appending malicious SQL commands to existing queries. By measuring the time delay in the server's response, the attacker can systematically extract sensitive data from the WordPress database. The vulnerability is present in all versions up to and including 4.13.

Affected products

Tribulant Newsletters (newsletters-lite) Up to and including 4.13

Timeline

2026-06-10: disclosed
2026-06-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.