CVE-2026-101325

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 4.18.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An attacker can obtain the required nonce and subscriberauth cookie without a WordPress account by simply subscribing through the public newsletter form and opening the management link sent via email; the ownership check verifies only the subscriber_id field and does not validate that the injected id parameter belongs to the authenticated subscriber.

• CWE-89

• https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.1/includes/checkinit.php#L269
• https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.1/models/subscriber.php#L1294
• https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.1/wp-mailinglist-plugin.php#L5008
• https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.18.1/wp-mailinglist-plugin.php#L5076
• https://plugins.trac.wordpress.org/changeset/3756587/newsletters-lite/trunk/wp-mailinglist-plugin.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d4bc05a2-25f9-4276-8541-a77efc7bd617?source=cve

Published

Oct 31, 2026

Last Modified

Nov 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10131An OS command injection vulnerability exists in the boa form…9.1
• CVE-2026-101310The HDA audio device model did not check for zero-length Buf…7
• CVE-2026-101311The framebuffer device model's maximum resolution constants …7
• CVE-2026-10132A stack-based buffer overflow vulnerability exists in the bo…9.1
• CVE-2026-101322In Eclipse BaSyx AAS Web UI versions v2-241220 through relea…8.3
• CVE-2026-101324The Fluent Forms – Customizable Contact Forms, Survey, Quiz,…4.7
• CVE-2026-101326The The Ninja Forms – Contact Form Builder with Calculators,…5.4
• CVE-2026-101329IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote a…6.5
• CVE-2026-10133A stack-based buffer overflow vulnerability exists in the ba…9.1
• CVE-2026-101331IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote a…6.5
• CVE-2026-101333A flaw was found in the Micrometer user-event metrics listen…3.7
• CVE-2026-101335The Forminator Forms – Contact Form, Payment Form & Custom F…6.5