Executive brief
The Newsletters plugin for WordPress, which manages email marketing and subscriber lists, contains a security flaw that allows unauthorized individuals to access private database information. By sending specially crafted requests, an attacker can bypass security measures to extract sensitive data such as user credentials or subscriber details. This could lead to a significant data breach and compromise the privacy of your mailing list subscribers.
Technical details
A time-based SQL injection vulnerability exists in the Newsletters plugin for WordPress due to improper neutralization of the 'wpmlsubscriber_id' parameter. The root cause is a failure to use sufficient escaping and SQL query preparation (wpdb::prepare) when handling user-supplied input. An unauthenticated attacker can exploit this over the network by appending malicious SQL commands to existing queries. By measuring the time delay in the server's response, the attacker can systematically extract sensitive data from the WordPress database. The vulnerability is present in all versions up to and including 4.13.
Affected products
- Tribulant Newsletters (newsletters-lite) Up to and including 4.13
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory