Accepting unsanitized user input during email subscription creates a blind SQL injection vector. An attacker can send crafted requests that the plugin forwards directly to the database without proper neutralization, allowing read and potentially modify operations on the underlying data store. This flaw does not require elevated privileges and could result in confidential post or user data disclosure, or in some contexts, database corruption or complete takeover of the site content. The vulnerability is a classic example of CWE-89.

The flaw is present in the seballero Emailing Subscription WordPress plugin version 1.4.1 and earlier. Administrators should confirm whether the site is running any of these affected releases.

The CVSS score of 9.3 classifies this as a high‑severity vulnerability, while the EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. Exploitation can be performed remotely by sending crafted HTTP requests to the plugin’s subscription endpoint, provided the plugin is enabled and the site is publicly reachable. No special network conditions are required beyond normal web traffic.