Unauthenticated SQL Injection in WordPress Newsletters Plugin wpmlsubscriber_id Parameter

Successful exploitation allows unauthenticated attackers to perform SQL injection against the WordPress site's backend database. Based on the provided information, the primary impact is extraction of sensitive information from the database through time-based blind techniques. Depending on database contents, this may expose subscriber data, WordPress user information, configuration data, and other application-resident secrets accessible to the vulnerable query context.

If immediate patching is not possible, reduce exposure by disabling the vulnerable Newsletters plugin or restricting access to the affected functionality where feasible. Deploying a WAF or virtual patch capable of detecting SQL injection payloads targeting the wpmlsubscriber_id parameter may help reduce exploitability, but should not be treated as a substitute for remediation. Additional defensive measures include minimizing database privileges used by the application and monitoring for anomalous time-based SQLi patterns in web and database logs.

Update the Newsletters plugin to a version newer than 4.13 once a vendor-fixed release is available. The vulnerable code path should be corrected by strictly validating and type-enforcing the wpmlsubscriber_id parameter and by using properly parameterized queries/prepared statements for all database access involving user-supplied input.