CVE-2026-3018

Name of the Vulnerable Software and Affected Versions Newsletters plugin for WordPress versions prior to 4.14

Description The plugin is susceptible to time-based SQL Injection, a technique where an attacker sends queries that force the database to wait a specific amount of time before responding, allowing them to infer data. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database via the wpmlsubscriber id parameter.

Recommendations Update the plugin to version 4.14 or later. As a temporary workaround, restrict access to the functionality utilizing the wpmlsubscriber id parameter.