Brief Summary: CVE-2026-3018 Unauthenticated SQL Injection in WordPress Newsletters Plugin

Introduction

Over 20,000 WordPress sites running the Newsletters plugin are exposed to unauthenticated database extraction through a time-based SQL injection vulnerability that requires nothing more than a crafted HTTP request. The flaw, tracked as CVE-2026-3018, is the third SQL injection disclosure in this plugin's history. The same patch fixed a separate authentication bypass, and the pair raises real concerns about the plugin's overall code quality.

The Newsletters plugin, developed by Tribulant Software, provides email marketing and newsletter management for WordPress sites. It has 20,000+ active installations and has been on the WordPress plugin repository since 2014. Its users are mostly mid-market site operators who need subscriber management and email campaign tools integrated directly into WordPress.

Technical Information

Root Cause

CVE-2026-3018 is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vulnerability is in how the wp-mailinglist-plugin.php file processes the wpmlsubscriber_id parameter. In version 4.11, the vulnerable code is around line 6040.

Two deficiencies compound each other. The plugin did not sufficiently escape the user-supplied wpmlsubscriber_id parameter, so attacker-controlled input reached the database query unsanitized. It also built SQL statements through direct string concatenation instead of using WordPress's $wpdb->prepare() method.

In the vulnerable pattern, user input from $_POST['subscriber_id'] was concatenated directly into a SQL string (e.g., $query = "SELECT ... WHERE id = " . $var). An attacker could inject arbitrary SQL fragments, and the database engine would execute them as part of the legitimate query.

CVSS Breakdown

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 (High). Its metrics break down as follows:

Attack Flow

This is a time-based blind SQL injection. Exploitation works like this:

1. The attacker identifies a WordPress site running the Newsletters plugin at version 4.13 or earlier. Standard WordPress enumeration techniques make the plugin easy to detect.

2. The attacker sends an HTTP request containing a crafted wpmlsubscriber_id parameter value. The payload includes time-delay SQL functions such as SLEEP() or BENCHMARK() in MySQL.

3. Because the parameter value is concatenated directly into the SQL query without escaping or parameterization, the injected SQL fragment becomes part of the executed query.

4. By measuring the HTTP response time, the attacker can infer boolean conditions about the database contents. For example, if a SLEEP(5) payload causes a 5-second delay, the attacker knows the injected condition evaluated to true.

5. Through iterative requests, the attacker extracts data one bit or character at a time. This is slower than in-band SQL injection but fully automatable with tools like sqlmap.

6. The high confidentiality impact rating reflects that an attacker can systematically extract the entire WordPress database, including user credentials, email addresses, subscriber data, site configuration, and any other stored information.

The vulnerability needs no authentication (PR:N) and no user interaction (UI:N), and it is reachable over the network (AV:N) with low complexity (AC:L). The barrier to exploitation is minimal, and automated scanning and exploitation at scale are entirely feasible.

The Fix in Changeset 3566485

Developer mohsenr1 committed the patch on June 9, 2026, modifying seven files. The main fix, in wp-mailinglist-plugin.php (13 diffs), replaced raw string concatenation with $wpdb->prepare() calls that use typed placeholders such as %d for integer values. Prepared queries keep SQL code and user data separate at the database driver level, so an injected payload cannot alter the query structure.

The same changeset also addressed CVE-2026-8978, an authentication bypass caused by predictable md5($subscriber->id) tokens used for cookie authentication. The fix replaced them with cryptographically secure tokens from wp_generate_password(32, false) and added an explicit guard that rejects predictable tokens. Two vulnerability classes turning up in a single patch release indicates broader security deficiencies in the codebase.

Affected Systems and Versions

The following versions are affected:

• Newsletters plugin for WordPress: All versions up to and including 4.13
• Plugin slug: newsletters-lite
• Fixed in: Version 4.14 (released June 9, 2026)

Any WordPress site running the Newsletters plugin at version 4.13 or earlier is vulnerable, whatever its WordPress core version or server configuration. The vulnerability is in the plugin's own PHP code and does not depend on any particular WordPress or MySQL version.

Vendor Security History

Tribulant Software's Newsletters plugin has a documented pattern of SQL injection vulnerabilities spanning nearly a decade:

SQL injection has recurred across versions 4.6.4.2, 4.9.9.7, and 4.13, which suggests a systemic issue with how the plugin constructs database queries rather than a series of isolated oversights. Predictable md5() tokens were still in use for authentication in 2026, a further sign that development did not consistently apply modern security practices.

Researcher wesley (wcraft) discovered and reported the vulnerability. Coordinated disclosure took place on June 9, 2026, and the NVD entry was published on June 10, 2026.

References

• NVD Entry for CVE-2026-3018
• Wordfence Threat Intel Advisory: Newsletters <= 4.13 Unauthenticated SQL Injection
• Wordfence Vulnerability Detail Page
• Changeset 3566485 for newsletters-lite (Patch Diff)
• Vulnerable Code in wp-mailinglist-plugin.php (Version 4.11, Line 6040)
• Newsletters Plugin on WordPress.org
• Patchstack: Prior SQL Injection in Newsletters Plugin (Version 4.9.9.7)
• NVD Entry for CVE-2026-8978 (Related Authentication Bypass)
• Exploit-DB: WordPress Plugin Tribulant Newsletters 4.6.4.2 (2017 Advisory)
• Tribulant Software Website
• Tribulant Software WordPress.org Profile
• CISA Known Exploited Vulnerabilities Catalog