The Newsletters plugin for WordPress contains a time‑based SQL injection flaw in the wpmlsubscriber_id parameter in all releases up to and including version 4.13. The parameter value is insufficiently escaped and the surrounding SQL query is not prepared, allowing an attacker to append arbitrary SQL statements. This weakness can be used to read sensitive information from the WordPress database, including user credentials, configuration data, and other confidential content. The flaw is a classic instance of injection, represented by CWE‑89.

Any WordPress installation running the contrid Newsletters plugin with a version of 4.13 or earlier is affected. No other product versions are known to be vulnerable and versions newer than 4.13 are presumed fixed.

The CVSS score of 7.5 indicates a high severity. The EPSS score is 1 %, showing a low probability of exploitation, yet the absence of an authentication requirement makes the vulnerability accessible to unauthenticated attackers. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote network via HTTP requests that supply a crafted wpmlsubscriber_id value; this inference is derived from the description that the parameter is exposed to unauthenticated traffic.