CVE-2022-0439: 
WordPress vulnerability analysis and mitigation

CVE-2022-0439 affects the Email Subscribers & Newsletters WordPress plugin versions below 5.3.2. The vulnerability was publicly disclosed on February 11, 2022, and involves a blind SQL injection vulnerability that can be exploited by users with roles as low as Subscriber (WPScan).

The vulnerability stems from improper escaping of the 'order' and 'orderby' parameters in the 'ajaxfetchreport_list' action. Additionally, the lack of CSRF protection for this action allows attackers to trick logged-in users into performing the action by clicking a malicious link. The vulnerability has been assigned a CVSS score of 7.7 (high) and is classified under CWE-89 (SQL Injection) (WPScan).

If exploited, the vulnerability allows attackers to perform blind SQL injection attacks, potentially enabling them to extract sensitive information from the database. The attack can be executed through specially crafted requests to the WordPress admin-ajax endpoint (WPScan).

The vulnerability has been fixed in version 5.3.2 of the Email Subscribers & Newsletters plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).