The Newsletters plugin for WordPress (contrid) suffers from a time-based SQL Injection vulnerability via the 'orderby' parameter due to insufficient escaping and lack of prepared statements in SQL queries. Authenticated attackers with Contributor-level privileges or above can exploit this to append malicious SQL commands, potentially extracting sensitive data from the database. The vulnerability affects all versions up to and including 4.9.9.8. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Successful exploitation allows an authenticated user with Contributor-level access or higher to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact integrity or availability according to the CVSS vector, but confidentiality is rated high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access carefully and monitor for unusual database activity related to the 'orderby' parameter. Avoid using the vulnerable plugin version or disable it if possible.