The Newsletters WordPress plugin contains a time‑based SQL Injection weakness that accepts the id parameter without sufficient escaping or query preparation. An attacker who is authenticated as a user with subscriber‑level access or higher can inject SQL statements into existing queries, allowing extraction of sensitive database contents. This flaw corresponds to CWE‑89, where improper input sanitization leads to arbitrary code execution at the database level.

WordPress installations running the Newsletters plugin in any version up to and including 4.18.1 are affected. No other plugin versions or components were identified as vulnerable in the provided data.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation is unclear. The vulnerability is not listed in CISA’s KEV catalog. Because authenticated subscribers can acquire the necessary nonce and subscriberauth cookie by simply visiting a subscription link, the attack requires only moderate effort and does not rely on advanced techniques. The risk focus is therefore on the potential loss of confidential database information rather than on denial of service or remote code execution.