{"id":"CVE-2026-122063","kind":"vulnerability","aliases":["CVE-2026-122063"],"related":[],"title":"Newsletters WordPress plugin: blind SQL injection via user_email parameter","description":"The Newsletters plugin for WordPress is vulnerable to blind SQL Injection via the 'user_email' parameter in all versions up to, and including, 4.18.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the admin-controlled 'currentusersubscribed' option to be enabled and at least one page rendering the Newsletters subscribe shortcode or widget to exist; a Subscriber-level attacker can self-serve the attack by updating their own profile email to a crafted payload and loading such a page.","summary":"The Newsletters plugin for WordPress, in versions up to and including 4.18.2, builds a database query from the user_email parameter without proper escaping or preparation. An authenticated subscriber can append SQL to existing queries and extract sensitive data from the site database.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Newsletters","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["newsletters-plugin","other","self-hosted","wordpress"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed Newsletters plugin version in the WordPress admin under Plugins; versions `4.18.2` and below are affected.\n- Check whether the admin option 'currentusersubscribed' is enabled for the Newsletters plugin.\n- Check whether any page uses the Newsletters subscribe shortcode or widget.","fix":null,"status":"open","published_at":"2026-11-13T10:17:27+00:00","first_seen_at":"2026-11-13T10:47:11+00:00","triaged_at":"2026-11-13T10:55:00+00:00","updated_at":"2026-11-13T10:55:00+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T10:55:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Newsletters WordPress plugin: blind SQL injection via user_email parameter","impact":"medium","summary":"The Newsletters plugin for WordPress, in versions up to and including 4.18.2, builds a database query from the user_email parameter without proper escaping or preparation. An authenticated subscriber can append SQL to existing queries and extract sensitive data from the site database.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","newsletters-plugin","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads sensitive database contents, such as user data and credentials.","analyst_note":"Confirm the patched Newsletters version and vendor advisory via the NVD entry; no fixed version is stated in the sources.","how_to_check":"- Check the installed Newsletters plugin version in the WordPress admin under Plugins; versions `4.18.2` and below are affected.\n- Check whether the admin option 'currentusersubscribed' is enabled for the Newsletters plugin.\n- Check whether any page uses the Newsletters subscribe shortcode or widget.","plain_action":"","product_name":"Newsletters","needs_analyst":true,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Sites running the Newsletters WordPress plugin version 4.18.2 or older. Exploitation requires the 'currentusersubscribed' option to be enabled and a page showing the Newsletters subscribe shortcode or widget; sites without these can skip it. Attackers need a subscriber-level account, which open registration may allow.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000788,"input_tokens":4712,"output_tokens":633,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122063':13A,16A '-2026':12A,15A '4.18.2':37B,92C 'access':123C 'addit':128C 'admin':150C 'admin-control':149C 'alreadi':132C 'append':56B,127C 'attack':118C,175C,181C 'authent':53B,117C 'blind':4A,77C 'build':38B 'control':151C 'craft':190C 'currentusersubscrib':152C 'cve':11A,14A 'data':64B 'databas':40B,68B,145C 'due':93C 'email':9A,45B,83C,187C 'enabl':156C 'escap':49B,96C 'exist':59B,109C,133C,170C 'exploit':146C 'extract':62B,140C 'host':24B 'includ':36B,91C 'inform':142C 'inject':6A,79C 'insuffici':95C 'lack':103C 'least':159C 'level':122C,174C 'load':193C 'make':113C 'newslett':1A,19B,27B,70C,164C 'newsletters':17A 'newsletters-plugin':18B 'one':160C 'option':153C 'page':161C,196C 'paramet':10A,46B,84C,101C 'payload':191C 'plugin':3A,20B,28B,71C 'possibl':115C 'prepar':51B,106C 'profil':186C 'proper':48B 'queri':41B,60B,111C,130C,134C 'render':162C 'requir':147C 'self':23B,178C 'self-host':22B 'self-serv':177C 'sensit':63B,141C 'serv':179C 'shortcod':166C 'site':67B 'sql':5A,57B,78C,110C,129C 'subscrib':54B,121C,165C,173C 'subscriber-level':120C,172C 'suffici':105C 'suppli':100C 'updat':183C 'use':138C 'user':8A,44B,82C,99C 'version':32B,87C 'via':7A,80C 'vulner':75C 'widget':168C 'without':47B 'wordpress':2A,25B,30B,73C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Newsletters WordPress plugin version 4.18.2 or older. Exploitation requires the 'currentusersubscribed' option to be enabled and a page showing the Newsletters subscribe shortcode or widget; sites without these can skip it. Attackers need a subscriber-level account, which open registration may allow.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["newsletters"],"ptokens":["newsletters"],"labels":["medium","newslettersplugin","other","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-122063':13A,16A '-2026':12A,15A 'blind':4A 'cve':11A,14A 'email':9A 'inject':6A 'newslett':1A 'newsletters':17A 'paramet':10A 'plugin':3A 'sql':5A 'user':8A 'via':7A 'wordpress':2A","search_b":"'4.18.2':37B 'append':56B 'authent':53B 'build':38B 'data':64B 'databas':40B,68B 'email':45B 'escap':49B 'exist':59B 'extract':62B 'host':24B 'includ':36B 'newslett':19B,27B 'newsletters-plugin':18B 'paramet':46B 'plugin':20B,28B 'prepar':51B 'proper':48B 'queri':41B,60B 'self':23B 'self-host':22B 'sensit':63B 'site':67B 'sql':57B 'subscrib':54B 'user':44B 'version':32B 'without':47B 'wordpress':25B,30B","search_c":"'4.18.2':92C 'access':123C 'addit':128C 'admin':150C 'admin-control':149C 'alreadi':132C 'append':127C 'attack':118C,175C,181C 'authent':117C 'blind':77C 'control':151C 'craft':190C 'currentusersubscrib':152C 'databas':145C 'due':93C 'email':83C,187C 'enabl':156C 'escap':96C 'exist':109C,133C,170C 'exploit':146C 'extract':140C 'includ':91C 'inform':142C 'inject':79C 'insuffici':95C 'lack':103C 'least':159C 'level':122C,174C 'load':193C 'make':113C 'newslett':70C,164C 'one':160C 'option':153C 'page':161C,196C 'paramet':84C,101C 'payload':191C 'plugin':71C 'possibl':115C 'prepar':106C 'profil':186C 'queri':111C,130C,134C 'render':162C 'requir':147C 'self':178C 'self-serv':177C 'sensit':141C 'serv':179C 'shortcod':166C 'sql':78C,110C,129C 'subscrib':121C,165C,173C 'subscriber-level':120C,172C 'suffici':105C 'suppli':100C 'updat':183C 'use':138C 'user':82C,99C 'version':87C 'via':80C 'vulner':75C 'widget':168C 'wordpress':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122063","severity":null,"published_at":"2026-11-13T10:17:27+00:00","modified_at":"2026-11-13T10:17:27+00:00","first_seen_at":"2026-11-13T10:47:11+00:00","fetched_at":"2026-11-13T10:47:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}