Read the docs
TI-2022-00362 Aliases CVE-2022-0439GHSA-9j96-8p8g-j5gr

Email Subscribers & Newsletters < 5.3.2 - Subscriber+ Blind SQL injection

Priority MEDIUM 45CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Tampering, SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-89.

Summary

The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.

Why it matters now

EPSS 0.04156 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Email Subscribers & Newsletters (Unknown): 5.3.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownEmail Subscribers & Newslettersbefore 5.3.25.3.2Patch availableCNA
  • Email Subscribers & Newsletters VendorUnknown Affected before 5.3.2 Fixed in 5.3.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:icegram:email_subscribers_\&_newsletters:*:*:*:*:*:wordpress:*:*before 5.3.2Vulnerableicegram
  • cpe:2.3:a:icegram:email_subscribers_\&_newsletters:*:*:*:*:*:wordpress:*:* Versions before 5.3.2 Vulnerable ·icegram

Remediation

  • Fix · CNA Email Subscribers & Newsletters (Unknown) Fixed in 5.3.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-0439
  2. 2026-10-03 Alias added: GHSA-9j96-8p8g-j5gr

References

Exploit 1

  • TI-2019-14600 There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1… CVSS 3.1CRITICAL 9.8
  • TI-2022-03650 Icegram Express < 5.5.1 - Subscriber+ SQLi CVSS 3.1HIGH 8.8
  • TI-2024-11421 Email Subscribers < 5.7.44 - Admin+ SQL Injection CVSS 3.1MEDIUM 6.5
  • TI-2019-14413 The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that… CVSS 3.1MEDIUM 5.3
  • TI-2024-11661 Email Subscribers < 5.7.45 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
  • TI-2024-11660 Email Subscribers < 5.7.45 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences