The Newsletters plugin for WordPress is vulnerable to a time‑based SQL injection via the wpmlsubscriber_id parameter in all versions up to and including 4.13. Because the parameter is not properly sanitized and the surrounding query is not prepared, an attacker can inject arbitrary SQL statements that are executed by the database. This flaw allows the attacker to read sensitive data stored in the WordPress database without authentication, potentially exposing user credentials, site configuration, and other confidential information. The weakness is an example of classic SQL injection, mapped to CWE‑89.

Vulnerable systems are those running the Newsletters plugin by contrid. Any installation using version 4.13 or earlier of the plugin is susceptible. No other versions are known to be affected, and versions newer than 4.13 are presumed to contain the fix.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the lack of an authentication barrier means the attack vector is considered unprivileged network. The vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker could remotely craft a request to the wpmlsubscriber_id parameter to retrieve data, as the description states that additional SQL queries can be appended to existing ones.