CVE-2026-7618

Vulnerability

The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress suffers from a time-based blind SQL injection vulnerability in the orderby parameter. The plugin fails to properly escape user input and lacks sufficient preparation on the SQL query, allowing attackers to inject malicious SQL. This affects all versions up to and including 2.4.5. The vulnerable endpoint is exposed via REST API routes as shown in the plugin's contactform7.php file [1][2].

Exploitation

An attacker must have administrator-level access to the WordPress site. By sending a crafted REST API request with a malicious orderby parameter, SQL commands are appended to the existing query. Due to insufficient escaping, the injection is time-based blind, requiring the attacker to observe response delays to extract data. No user interaction is required beyond the attacker's own admin session.

Impact

Successful exploitation allows the attacker to extract sensitive information from the WordPress database, such as user credentials, email addresses, and other data. The attack is limited to data disclosure (confidentiality impact) and does not enable file modification or remote code execution. The attacker retains the admin privilege level but can exfiltrate data from the entire database.

Mitigation

As of the publication date, no fix has been released for versions up to 2.4.5. Affected users should restrict access to admin-level accounts, monitor for suspicious REST API activity, and consider disabling the plugin until an update is available. The CVE is not listed in the Known Exploited Vulnerabilities catalog.