CVE-2025-3107
Published
CVSS v3
6.5
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby' parameter in all versions up to, and including, 4.9.9.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
<p>A full-featured WordPress newsletter plugin created by <a href="https://tribulant.com" rel="nofollow ugc">Tribulant</a> for WordPress which fulfills all subscribers, emails, marketing and newsletter related needs for both personal and business environments.</p>
<p>It has robust, efficient and unique features! This is an all-in-one newsletter tool for your WordPress site can be configured to behave as desired and it will provide the best experience for your email subscribers at the same time.</p>
<p>The software works the way you do so you can focus on creating newsletters and giving your website the necessary exposure!</p>
<h4>Features</h4>
<p>Some of the features in the WordPress Newsletter plugin include (see PRO Version section below to view the limitations of this LITE version):</p>
<ul>
<li>Mailing Lists </li>
<li>Bounce Email Management </li>
<li>Newsletter Queue & Scheduling </li>
<li>Newsletter Templates </li>
<li>Drag & Drop Newsletter & Template Builder </li>
<li>Complete Email History </li>
<li>Unlimited Sidebar Widgets </li>
<li>Post/Page Opt-In Embedding </li>
<li>Subscription Forms Builder </li>
<li>Offsite Subscription Forms </li>
<li>Publish Newsletter as a Post </li>
<li>Send Post as a Newsletter </li>
<li>Add Email Attachments </li>
<li>SMTP Authentication </li>
<li>Ajax Powered Features </li>
<li>Import/Export Subscribers </li>
<li>Paid Subscriptions (PayPal & 2Checkout) </li>
<li>Integrates with our Banner Rotator plugin </li>
<li>WordPress Multisite Compatible </li>
<li>Email Tracking </li>
<li>IP Logging of Subscribers </li>
<li>Google reCAPTCHA v2 </li>
<li>Google reCAPTCHA v3 </li>
<li>hCaptcha </li>
<li>Cloudflare Turnstile </li>
<li>Really Simple CAPTCHA </li>
<li>Newsletter Themes </li>
<li>POP/IMAP Bounce Handling </li>
<li>Latest Posts Subscriptions </li>
<li>Single/Multiple Posts into Emails </li>
<li>Bitly click tracking </li>
<li>Autoresponders </li>
<li>Newsletters by conditions </li>
<li>Multilingual (qTranslate & WPML) </li>
<li>Custom Post Types </li>
<li>Custom Fields </li>
<li>Link/click tracking </li>
<li>DKIM Signature </li>
<li>WordPress Dashboard Widget </li>
<li>and much more…</li>
</ul>
<p>See the newsletter subscribe forms builder in action:</p>
<p><span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/ZHbXN72eqmU?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span></p>
<h4>Demo and Support</h4>
<p>See the <a href="https://tribulant.net/newsletter/" rel="nofollow ugc">online demonstration</a> and view the <a href="https://tribulant.com/docs/wordpress-mailing-list-plugin/31/" rel="nofollow ugc">online documentation</a> for tips, tricks, guides, and more.</p>
<h4>Extensions</h4>
<p>There are many free and paid extension plugins for the WordPress Newsletter plugin. All extensions work with both Newsletters LITE and Newsletters PRO, no problem.</p>
<p>Some extensions include:</p>
<ul>
<li><a href="https://tribulant.com/extensions/view/42/woocommerce-subscribers" rel="nofollow ugc">WooCommerce Subscribers</a></li>
<li><a href="https://tribulant.com/extensions/view/28/contact-form-7-subscribers" rel="nofollow ugc">Contact Form 7 Subscribers</a></li>
<li><a href="https://tribulant.com/extensions/view/46/google-analytics" rel="nofollow ugc">Google Analytics Tracking</a></li>
<li><a href="https://tribulant.com/extensions/view/6/embedded-images" rel="nofollow ugc">Embedded Images</a></li>
<li><a href="https://tribulant.com/extensions/view/26/total-ms-control" rel="nofollow ugc">Total MS Control</a></li>
<li><a href="https://tribulant.com/extensions/view/17/gravity-forms-subscribers" rel="nofollow ugc">Gravity Forms Subscribers</a></li>
<li><a href="https://tribulant.com/extensions/view/16/formidable-subscribers" rel="nofollow ugc">Formidable Subscribers</a></li>
<li><a href="https://tribulant.com/extensions/view/43/digital-access-pass" rel="nofollow ugc">Digital Access Pass Subscribers</a></li>
<li><a href="https://tribulant.com/extensions/view/36/total-control" rel="nofollow ugc">Total Control</a></li>
<li><a href="https://tribulant.com/extensions/view/32/s2member-subscribers" rel="nofollow ugc">s2Member Subscribers</a></li>
<li><a href="https://tribulant.com/extensions/view/31/wp-emember-subscribers" rel="nofollow ugc">WP eMember Subscribers</a></li>
</ul>
<p><a href="https://tribulant.com/plugins/extensions/1/wordpress-newsletter-plugin" rel="nofollow ugc">Visit the Newsletters extensions page</a></p>
<h4>Email/Newsletter Templates</h4>
<p>Included with the newsletter plugin are several premade email/newsletter templates.</p>
<p>Shop our <a href="https://tribulant.com/emailthemes/" title="newsletter templates" rel="nofollow ugc">newsletter templates</a> for more variety and high quality, premium, responsive newsletter templates.</p>
<h4>Languages</h4>
<p>All language files and the instructions to use them are in <a href="https://poeditor.com/join/project/b31cab38f30cec409424dc273a131183" rel="nofollow ugc">POEditor</a>. Anyone can join the project to add languages and contribute translations for strings.</p>
<p>Thank you for these wonderful people who contributed in translating the plugin:</p>
<ul>
<li>Afrikaans (af_ZA) by <a href="https://www.contrid.co.za" rel="nofollow ugc">Antonie Potgieter</a></li>
<li>German (de_DE) by Peter Schonmann</li>
<li>Greek (el_GR) by <a href="https://www.aio.gr" rel="nofollow ugc">Harris Karanikolas | AiO Systems Information</a></li>
<li>Spanish (es_ES) by Juan Llamosas</li>
<li>French (fr_FR) by Kim Gjerstad</li>
<li>Hungarian (hu_HU) by <a href="https://www.idsign.hu" rel="nofollow ugc">iD Sign | Gergely Almasi</a></li>
<li>Italian (it_IT) by <a href="https://www.playcodestudio.com" rel="nofollow ugc">Matteo Galli | Playcode</a>, Johnny</li>
<li>Lithuanian (lt_LT) by Tomas</li>
<li>Dutch (nl_NL) by <a href="https://www.webzenz.nl" rel="nofollow ugc">Ronald de Caluwe | WebZenz</a></li>
<li>Brazilian Portuguese (pt_BR) by Vitor Argos</li>
<li>Portuguese (pt_PT) by wordpress.mowster.net</li>
<li>Romanian (ro_RO) by <a href="https://richardconsulting.ro" rel="nofollow ugc">Richard Vencu</a></li>
<li>Swedish (sv_SE) by Tomas Lindhoff</li>
<li>Turkish (tr_TR) by Sersah Namoglu</li>
</ul>
<h4>Offsite HTML Code</h4>
<pre><code><script type="text/javascript"> var wpmlAjax = "' . $this -> url() . '/' . $this -> plugin_name . '-ajax.php"; </script>
<script type="text/javascript" src="' . $this -> url() . '/js/wp-mailinglist.js"></script>
<script type="text/javascript" src="' . get_option('siteurl') . '/wp-includes/js/scriptaculous/prototype.js"></script>
<script type="text/javascript" src="' . get_option('siteurl') . '/wp-includes/js/scriptaculous/scriptaculous.js?load=effects"></script>'
</code></pre>
<h4>API Example</h4>
<pre><code><?php
$url = 'https://example.com/wp-admin/admin-ajax.php?action=newsletters_api';
$data = array(
'api_method' => 'subscriber_add',
'api_key' => '37C1D6053E817212348E507D29CCCE49',
'api_data' => array(
'email' => "[email protected]",
'list_id' => array(1,2,3),
)
);
$data_string = wp_json_encode($data);
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data_string);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'Content-Length: ' . strlen($data_string))
);
$result = json_decode(curl_exec($ch));
curl_close($ch);
?>
</code></pre>
<h4>PRO Version</h4>
<p>The Newsletters LITE version has nearly all of the features that the PRO version has but it has some limitations:</p>
<ul>
<li>One mailing list.</li>
<li>500 max subscribers.</li>
<li>Send up to 1000 emails per month.</li>
<li>Mail Type: Local Server and SMTP. No API integration with our <a href="https://tribulant.com/docs/wordpress-mailing-list-plugin/10570/sending-apis/" rel="nofollow ugc">mail service providers</a>.</li>
<li>The “Drag & Drop Newsletter & Template Builder” cannot be used.</li>
<li>Limited to Really Simple CAPTCHA and Google reCAPTCHA v2. The rest (reCAPTCHA v3, hCaptcha, Cloudflare Turnstile) cannot be used.</li>
<li>No new custom dynamic fields can be added but you can edit current ones.</li>
<li>No Resend button for emails and for the Send Manage Subscription Email link.</li>
</ul>
<p>These limits should be sufficient for a personal blogger or a small business.</p>
<p>To remove these limits, you can upgrade to the PRO version and submit your serial key inside the plugin.<br />
Or, download, install, and activate the PRO version from our website under Downloads, and then add your serial key. This is the preferred method. After installing the PRO version, you can safely deactivate and delete the LITE version without losing your data.</p>
<p>In addition to the limits being removed, you will receive <a href="https://tribulant.com/support/" rel="nofollow ugc">priority support</a> from <a href="https://tribulant.com" rel="nofollow ugc">Tribulant</a>.</p>
<p><a href="https://tribulant.com/plugins/view/1/wordpress-newsletter-plugin" rel="nofollow ugc">Visit the Newsletters PRO page</a></p>
<h4>3rd-Party Services</h4>
<p>Our plugin makes use of some 3rd-party services or APIs to provide you with the latest technology and functionality. Here is a list of the services:</p>
<ul>
<li>Postmark Spam Check API (https://spamcheck.postmarkapp.com/) – Fetch the spam score of an email/newsletter</li>
<li>IPEcho (https://ipecho.net/) – Get the current mail exchange IP address</li>
<li>IPLocate (https://www.iplocate.io/) – To get the country of a user by IP address</li>
<li>HostIP.info (https://www.hostip.info/) – To get the country of a user by IP address</li>
<li>geoPlugin (https://www.geoplugin.com/) – To get the country of a user by IP address</li>
</ul>