CVE-2026-101325

Name of the Vulnerable Software and Affected Versions Newsletters plugin for WordPress versions prior to 4.18.2

Description Authenticated attackers with subscriber-level access and above can perform a time-based SQL Injection. This occurs due to insufficient escaping of the user-supplied id parameter and a lack of sufficient preparation of the SQL query. Attackers can append additional SQL queries to extract sensitive information from the database. An attacker can obtain the necessary nonce and subscriberauth cookie without a pre-existing WordPress account by subscribing via the public newsletter form and accessing the management link sent by email, as the ownership check only verifies the subscriber id field and fails to validate if the injected id parameter belongs to the authenticated subscriber.

Recommendations Update the Newsletters plugin for WordPress to version 4.18.2 or later. Avoid using the id parameter in the affected plugin functions until the update is applied.