This vulnerability is an unauthenticated SQL injection flaw in WordPress plugins provided by Weblizar, specifically the Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin versions up to and including 1.5.9. An attacker who can submit input through the subscription form can inject arbitrary SQL statements, potentially granting them read or write access to the database, allowing data exfiltration, modification, or even full database compromise. The weakness stems from improper input validation when processing the email field. The impact on confidentiality, integrity, and availability is severe, as the attacker could manipulate or delete subscription data and compromise the entire site if the database is fully exposed.

Systems affected include any WordPress installation that has installed Weblizar’s Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin version 1.5.9 or earlier. The plugin is used for collecting user email subscriptions. No other vendors or products are listed in the current CNA data.

The CVSS score of 9.3 classifies this vulnerability as critical. The EPSS score of < 1% indicates a very low probability of exploitation, although the lack of authentication requirement means that anyone who can reach the subscription form can attempt exploitation. The vulnerability has not yet been listed in CISA’s KEV catalog, indicating no widely reported exploits to date. However, the high severity and ease of access make it a top priority for remediation.