# CVE-2022-0439: Email Subscribers & Newsletters - SQLi

> Live exploitation tracking for CVE-2022-0439 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-0439

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.8
- **Public exploit available:** Yes
- **Affected products:** Icegram Email Subscribers & Newsletters
- **Weaknesses:** CWE-352 (Cross-Site Request Forgery (CSRF)); CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** wordpress, cms

## Description

The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.

## CrowdSec analysis

[CVE-2022-0439](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-0439) is a high-severity vulnerability in the Email Subscribers & Newsletters WordPress plugin that allows users with minimal privileges, such as Subscribers, to exploit a blind SQL injection flaw via improperly sanitized parameters. The lack of CSRF protection further enables attackers to trick logged-in users into executing malicious actions, potentially leading to unauthorized access, data leakage, or manipulation of the underlying database.

CrowdSec has been tracking this vulnerability and its exploits since 25th of March 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2022-0439 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/wp-admin/admin-ajax.php` endpoint with the `action=ajax_fetch_report_list` parameter, injecting SQL payloads via the `order` parameter to perform authenticated SQL injection attacks against vulnerable WordPress sites.

## Timeline

- 2022-03-07: CVE Published. CVE-2022-0439 is published to NVD.
- 2026-03-25: Rule Released. CrowdSec releases a rule to detect CVE-2022-0439 exploitation attempts against the CrowdSec Network.
- 2026-08-18: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-0439 for the first time.

## References

- https://wpscan.com/vulnerability/729d3e67-d081-4a4e-ac1e-f6b0a184f095
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0439.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-0439) follows observed exploitation activity for CVE-2022-0439. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.