CVE-2026-3018: Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter

Synopsis

Time-based SQL injection in the Newsletters plugin for WordPress (versions up to and including 4.13) allows an unauthenticated remote attacker to manipulate the wpmlsubscriber_id parameter and append arbitrary SQL to existing database queries. The vulnerability is reachable over the network with no login required and no victim interaction needed. Successful exploitation extracts sensitive data from the WordPress database. No fix version has been published; HarborGuard tracks the advisory and will make a patched rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable parameter is exposed over the network via HTTP requests to the WordPress installation, so the attacker must be able to reach the service remotely.

• AuthenticationNot required

  No account or session token is needed; the wpmlsubscriber_id parameter accepts unauthenticated input.

• Victim interactionNot required

  The attacker sends crafted requests directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the injection point is consistently reachable and requires no special memory layout, race condition, or environmental prerequisite beyond network access.

Blast Radius

• Reads arbitrary rows from the WordPress database, including user credentials (hashed passwords), email addresses, and session tokens stored in the wp_users and wp_usermeta tables.
• Extracts plugin and site configuration data, subscriber lists, and any personally identifiable information stored by the Newsletters plugin.
• Enables enumeration of WordPress user roles and privilege levels, giving an attacker a map for follow-on account-takeover attempts.