CVE-2022-0439

CVE-2022-0439 is a high-severity blind SQL injection vulnerability affecting the Email Subscribers & Newsletters WordPress plugin prior to version 5.3.2. It allows authenticated users, even subscribers, to execute arbitrary SQL queries due to improper escaping of 'order' and 'orderby' parameters. The vulnerability is compounded by a lack of CSRF protection, enabling attackers to trick logged-in users into performing the malicious action. With a CVSS score of 8.8 (High), successful exploitation could lead to full compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, exploit code has been observed in GitHub and Nuclei, and it has garnered significant community discussion, indicating potential for active exploitation.