CVE-2025-67999: 
WordPress vulnerability analysis and mitigation

CVE-2025-67999 is a Blind SQL Injection vulnerability in the WordPress Newsletter plugin by Stefano Lissa, affecting all versions through 9.0.9. The vulnerability was reported by researcher Doan Dinh Van on November 27, 2025, and publicly disclosed by Patchstack on December 15–16, 2025. It carries a CVSS v3.1 base score of 7.6 (High), assigned by Patchstack, with exploitation requiring high privileges (Administrator/Developer level) (Patchstack).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and enables Blind SQL Injection, meaning an attacker cannot directly see query results but can infer database contents through conditional responses or time-based techniques. Exploitation requires an authenticated session with Administrator or Developer-level privileges on the WordPress installation, limiting the attack surface to privileged users. The attack vector is network-based with low complexity, and the scope is changed, indicating impact can extend beyond the vulnerable component itself (Patchstack).

Successful exploitation allows a privileged attacker to interact directly with the underlying WordPress database, with high confidentiality impact — enabling extraction of sensitive data such as user credentials, email subscriber lists, and site configuration. Integrity impact is low (limited data manipulation), and availability is not directly affected. Because the scope is changed, the impact can extend beyond the Newsletter plugin itself to other data stored in the shared WordPress database (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-67999. The EPSS score is approximately 0.021% (0.000210), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority with no impactful threat currently observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this vulnerability (detection ID 530765) (Patchstack).

The vulnerability is patched in Newsletter plugin version 9.1.0. WordPress site administrators should update the Newsletter plugin to version 9.1.0 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting Administrator and Developer-level access to trusted users only can reduce the attack surface (Patchstack).

Sucuri included CVE-2025-67999 in their December 2025 vulnerability patch roundup, noting it as part of a broader set of WordPress plugin issues requiring attention. Patchstack, which discovered and disclosed the vulnerability, rates it as low priority with no impactful threat currently observed, suggesting limited community alarm. No significant threat actor attribution or notable researcher commentary beyond the initial disclosure has been identified.