CVE-2022-0439: The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the…

PriorityP259high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EXPLOIT

EPSS

4.18%

89.7th percentile

The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
icegram	email_subscribers_newsletters	< 5.3.2	5.3.2

Detection & IOCsextracted from sources · hover to see the quote

sigma

status_code == 200 AND contains(body, 'column-email')

→Blind SQL injection is triggered via the `order` and `orderby` parameters in the `ajax_fetch_report_list` action of the Email Subscribers & Newsletters plugin. Monitor POST/GET requests to this action endpoint for anomalous or unsanitized values in those parameters. ↗
→The action has no CSRF protection; watch for cross-origin or forged requests targeting `ajax_fetch_report_list` from low-privileged (Subscriber-level) authenticated sessions. ↗
→HTTP responses containing the string `column-email` with a 200 status code may indicate successful exploitation of the SQL injection via the report list endpoint.
→A payload of `= 10'` (single-quote injection) appended to a parameter value is used as a probe for the blind SQL injection vulnerability in this plugin.

·Exploitation requires the attacker to have at minimum a Subscriber-level authenticated session, or to trick an already-authenticated user into clicking a crafted link (CSRF vector). ↗
·The vulnerability is present in versions of the Email Subscribers & Newsletters plugin before 5.3.2; ensure patched version is deployed. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.