The Newsletter plugin for WordPress, developed by Stefano Lissa, has an improper handling of user-supplied input in SQL statements, classified as CWE-89. This flaw allows blind SQL injection, meaning an attacker could insert arbitrary SQL code that may enable reading, modifying, or deleting data from the WordPress database.

All versions of the Newsletter plugin up to and including version 9.0.9 are affected. Any WordPress installation that has installed one of these versions is vulnerable.

The CVSS score of 7.6 indicates high severity, while the EPSS score of less than 1 % shows that exploitation is possible but not widespread. The vulnerability is not listed in the CISA KEV catalog. Attackers can potentially exploit it by sending crafted requests to the plugin’s endpoints that accept user input, taking advantage of the lack of sanitization. The injection is blind, so attackers might infer data through timing or error-based responses. The likely attack vector is through HTTP requests handled by the plugin.