CVE-2026-101325— Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter

Quick assessment

Affected

contrid Newsletters

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Newsletters 插件在所有 4.18.1 及更早版本中存在基于时间的 SQL 注入漏洞。该漏洞源于对用户提供的"id"参数缺乏足够的转义处理，以及现有 SQL 查询未进行充分的预处理。这使得拥有订阅者级别或更高权限的已认证攻击者能够向已有的 SQL 查询中追加额外的查询语句，从而从数据库中窃取敏感信息。攻击者无需拥有 WordPress 账户，仅需通过公开的新闻订阅表单进行订阅，并打开通过邮件发送的管理链接，即可获取所需的 nonce 和 subscriberauth Cookie；

CVSS 5.3 · Medium EPSS 0.25% · P17 Updated Nov 01, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
contrid	Newsletters	`≤ 4.18.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter

Source: CVE Program / CVE List V5

Vulnerability Description

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 4.18.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An attacker can obtain the required nonce and subscriberauth cookie without a WordPress account by simply subscribing through the public newsletter form and opening the management link sent via email; the ownership check verifies only the subscriber_id field and does not validate that the injected id parameter belongs to the authenticated subscriber.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
contrid	Newsletters	0 ~ 4.18.1	-

II. Public POCs for CVE-2026-101325

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-101325

请登录查看更多情报信息。

Other References for CVE-2026-101325 (6)

https://www.cve.org/CVERecord?id=CVE-2026-101325

IV. Related Vulnerabilities

Same product: Newsletters

Same vendor: contrid

Same weakness: CWE-89