CVE-2019-20361: WordPress Email Subscribers & Newsletters plugin blind SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit references, and very high EPSS make this an urgent patch target.

What it is

The Email Subscribers & Newsletters WordPress plugin before 4.3.1 passes the hash parameter to the database without proper sanitization, allowing blind SQL injection. This is a critical, remotely reachable flaw in a widely deployed plugin, so unauthenticated attackers can extract or manipulate database contents.

Impact

An attacker can read arbitrary data from the WordPress database, including user credentials and subscriber records, and may alter or delete data depending on database privileges.

Attack surface

Reached over the network through the plugin's hash parameter; the CVSS vector shows no privileges or user interaction required, so it is unauthenticated and remotely exploitable.

Exploitation

CISA KEV does not list it, but EPSS is 0.8511 (99.7th percentile) and references are tagged Exploit, indicating public exploit code exists and exploitation is likely.

What to do

• Update the Email Subscribers & Newsletters plugin to version 4.3.1 or later immediately.
• If patching is not possible, disable or remove the plugin until it can be updated.
• Restrict access to WordPress admin and plugin endpoints via WAF rules or IP allowlisting where feasible.
• Audit database accounts used by WordPress for least privilege and rotate credentials if compromise is suspected.
• Review logs for requests containing SQL syntax in the hash parameter.

Detection

• Search web server and WAF logs for requests with SQL keywords or comment sequences in the hash parameter.
• Monitor for unusual database queries or errors originating from the plugin's endpoints.
• Check for unexpected changes to WordPress users, options, or subscriber tables.
• Use file integrity monitoring to detect modified plugin files or dropped webshells.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.