CVE-2026-3018 is a SQL Injection vulnerability in the WordPress Newsletters plugin by contrid. The issue arises from improper neutralization of special elements in the 'wpmlsubscriber_id' parameter, enabling unauthenticated attackers to append additional SQL queries. This is due to insufficient escaping of user-supplied input and lack of prepared statements in the SQL query construction. The vulnerability affects all plugin versions up to and including 4.13 and can be exploited to extract sensitive data via time-based SQL Injection techniques. No known exploits are reported in the wild, and no official remediation or patch has been published as of the data provided.

Successful exploitation allows unauthenticated attackers to perform time-based SQL Injection attacks, potentially extracting sensitive information from the backend database. The vulnerability does not impact integrity or availability directly but compromises confidentiality by exposing data. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable parameter if possible, or applying web application firewall (WAF) rules to detect and block SQL Injection attempts targeting the 'wpmlsubscriber_id' parameter. Monitor vendor channels for updates and apply official patches promptly once available.