CVE-2026-7618 is a time-based blind SQL Injection vulnerability in the EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress. It arises from improper neutralization of special elements in the 'orderby' parameter, allowing authenticated administrators to append malicious SQL queries. The vulnerability affects all versions up to and including 2.4.5. The lack of sufficient escaping and query preparation enables attackers to extract sensitive information from the database. The CVSS 3.1 base score is 4.9 (medium severity), with network attack vector, low attack complexity, and requiring high privileges.

An authenticated attacker with administrator-level access can exploit this vulnerability to perform time-based blind SQL Injection attacks, potentially extracting sensitive information from the plugin's database. There is no indication of impact on data integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the 'orderby' parameter. Avoid using affected plugin versions if possible.