WordPress Newsletters Plugin SQL Injection via Subscriber ID

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, and including, 4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Newsletters plugin for WordPress contains a time-based SQL injection vulnerability in the 'wpmlsubscriber_id' parameter affecting all versions up to 4.13. This CWE-89 vulnerability stems from insufficient escaping and lack of parameterized query preparation, allowing unauthenticated attackers to inject malicious SQL code directly into database queries. The vulnerability is particularly dangerous because it requires no authentication, making any WordPress site running the vulnerable plugin an immediate target. Attackers can extract sensitive information including user credentials, personal data, and configuration details from the database, potentially leading to complete site compromise or lateral movement into connected systems.

Casky's 754 security skills, powered by Claude AI's extended reasoning capabilities, map this attack pattern across MITRE ATT&CK TA0001 (Reconnaissance) and TA0043 (Reconnaissance) techniques. Practitioners using Casky would observe detection of SQL query anomalies, time-delay patterns in database responses, and suspicious parameter manipulation attempts in their web application logs. The platform's skills identify the characteristic signatures of time-based blind SQL injection: delayed response times correlating with injected conditional statements, unusual database query structures, and attempts to extract data through boolean-based or time-based inference. Security teams would see specific findings highlighting the vulnerable parameter name, the injection point location, and recommended remediation steps—including immediate plugin updates to version 4.14 or later, alongside WAF rules to block malformed 'wpmlsubscriber_id' parameters.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-3018.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-3018

Casky has 301 skills that investigate the attack patterns behind CVE-2026-3018. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn