Executive brief
The Newsletters WordPress plugin, used to manage email marketing campaigns, contains a SQL injection flaw in its administrator interface. An attacker with admin access could exploit this to read, modify, or delete the entire website database including user accounts and sensitive data, potentially leading to complete site compromise.
Technical details
A SQL injection vulnerability exists in the Newsletters WordPress plugin versions <= 4.18 that allows attackers with administrator privileges to inject arbitrary SQL queries. The vulnerable component is part of the administrative interface where user input is not properly sanitized or parameterized before being passed to database queries. Although exploitation requires prior admin access, a compromised administrator account or privilege escalation via another vulnerability could enable full database exfiltration, modification, or destruction. The vulnerability has been patched in version 4.18.1 and later.
Affected products
- WordPress.org Newsletters <= 4.18
Timeline
- 2026-09-08: disclosed: Reported to Patchstack
- 2026-09-17: advisory: Published by Patchstack
- 2026-09-17: patched: Fixed in version 4.18.1