CVE-2025-30921: 
WordPress vulnerability analysis and mitigation

An SQL Injection vulnerability (CVE-2025-30921) was discovered in Tribulant Software Newsletters affecting versions through 4.9.9.7. The vulnerability was disclosed on March 27, 2025, and allows authenticated administrators to perform SQL injection attacks against the application (Patchstack).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) with a CVSS v3.1 base score of 7.6 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L). The issue requires administrator-level privileges to exploit (NVD).

If exploited, this vulnerability could allow an authenticated administrator to directly interact with the database, potentially leading to unauthorized access to sensitive information. The CVSS score indicates high confidentiality impact and low availability impact (Patchstack).

The vulnerability requires administrator-level access to exploit, which somewhat limits its potential impact. The attack complexity is rated as low, indicating that once an attacker has the required privileges, the vulnerability is relatively straightforward to exploit (NVD).

The vulnerability has been patched in version 4.9.9.8 of the Newsletters plugin. Users are advised to update to this version or later to remediate the vulnerability (Patchstack).