CVE-2026-122063: Newsletters <= 4.18.2 - Authenticated (Subscriber+) SQL Injection via 'user_email' User Meta
The Newsletters plugin for WordPress is vulnerable to blind SQL Injection via the 'useremail' parameter in all versions up to, and including, 4.18.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the admin-controlled 'currentusersubscribed' option to be enabled and at least one page rendering the Newsletters subscribe shortcode or widget to exist; a Subscriber-level attacker can self-serve the attack by updating their own profile email to a crafted payload and loading such a page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the admin-controlled 'currentusersubscribed' option to prevent this exploit path.
Newsletters for WordPress currentusersubscribed = disabled
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker can update their own profile email address to a crafted value and then load a page containing the affected subscription interface.
What site configuration is required for exploitation?
The administrator-controlled currentusersubscribed option must be enabled. The site must also have at least one page that renders the Newsletters subscribe shortcode or widget.
What information could an attacker obtain?
The SQL injection is blind, but it can be used to extract sensitive information from the WordPress database. The provided impact information indicates confidentiality impact only, with no stated integrity or availability impact.
How can I determine whether my site is exposed?
Check whether the Newsletters plugin version is 4.18.2 or earlier, whether currentusersubscribed is enabled, and whether any page renders the Newsletters subscribe shortcode or widget. Sites lacking either required configuration condition are not described as exploitable by the provided information.