PT-2026-48398 · WordPress · Newsletters

Wesley · CVE-2026-3018 · Published 2026-06-10 · Updated 2026-06-11

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Newsletters plugin for WordPress versions prior to 4.14

Description The plugin is susceptible to time-based SQL Injection, a technique where an attacker sends queries that force the database to wait a specific amount of time before responding, allowing them to infer data. This occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database via the wpmlsubscriber id parameter.

Recommendations Update the plugin to version 4.14 or later. As a temporary workaround, restrict access to the functionality utilizing the wpmlsubscriber id parameter.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-3018

Affected Products

Newsletters

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-3018 · Security Note
• https://t.me/cveNotify/166810 · Telegram Post
• https://twitter.com/CVEnew/status/2064709838278410620 · Twitter Post
• https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.11/wp-mailinglist-plugin.php#L6040 · Note
• https://twitter.com/atomicedgeWAF/status/2064853918736076984 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2065026292920238235 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3566485/newsletters-lite · Note
• https://t.me/CVEtracker/56435 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8e2672b5-64a2-4b30-b0be-2a9303d46ac1?source=cve · Note