CVE-2026-7618

Name of the Vulnerable Software and Affected Versions EnvíaloSimple: Email Marketing y Newsletters versions prior to 2.4.6

Description Authenticated attackers with administrator-level access and above can perform a time-based blind SQL Injection. This occurs due to insufficient escaping of the user-supplied orderby parameter and a lack of sufficient preparation on the existing SQL query, allowing the addition of malicious SQL queries to extract sensitive information from the database.

Recommendations Update EnvíaloSimple: Email Marketing y Newsletters to version 2.4.6 or later. As a temporary mitigation, restrict access to the orderby parameter for administrative users until the update is applied.