{"id":"CVE-2026-110184","kind":"vulnerability","aliases":["CVE-2026-110184"],"related":[],"title":"Newsmatic WordPress theme: unauthenticated SQL injection exposes database contents","description":"The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","summary":"The Newsmatic theme for WordPress, in all versions up to and including 1.5.0, passes the 'slug' parameter into a SQL query without proper escaping or preparation. An unauthenticated attacker can append their own SQL queries and extract sensitive data from the site's database.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"newsmatic","fixed":["1.5.1"],"affected":"<= 1.5.0","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["newsmatic-theme","other","self-hosted","sql-injection","wordpress","wordpress-theme"],"not_affected_if":["managed-hosting-with-waf","newer-version","newsmatic-not-installed","theme-not-installed","version-1.5.1-or-later"],"how_to_check":"In WordPress admin go to Appearance > Themes and check the Newsmatic version, or read the Version line in wp-content/themes/newsmatic/style.css. Versions 1.5.0 and earlier are vulnerable. Child themes of Newsmatic inherit the parent's code, so check the parent too. With WP-CLI: wp theme list --name=newsmatic --fields=name,version,status.","fix":"Update the Newsmatic theme to 1.5.1 or later (WordPress.org currently lists 1.5.2). Patchstack names 1.5.1 as the patched version.","status":"open","published_at":"2026-10-29T12:17:09+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","triaged_at":"2026-10-29T12:25:31+00:00","updated_at":"2026-10-29T12:27:52+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-29T12:25:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Newsmatic WordPress theme: unauthenticated SQL injection exposes database contents","impact":"high","summary":"The Newsmatic theme for WordPress, in all versions up to and including 1.5.0, passes the 'slug' parameter into a SQL query without proper escaping or preparation. An unauthenticated attacker can append their own SQL queries and extract sensitive data from the site's database.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","newsmatic-theme","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads sensitive database contents, including credentials and user data.","analyst_note":"Check the NVD entry and the theme vendor's changelog for a fixed version and whether a default install is exposed.","how_to_check":"- Check the installed theme's version in the WordPress admin under Appearance > Themes, or in the theme's `style.css` header.\n- Confirm whether the Newsmatic theme is the active theme or is installed at all.","plain_action":"","needs_analyst":true,"not_affected_if":["theme-not-installed","newer-version"],"who_is_affected":"WordPress sites that have the Newsmatic theme installed, at version 1.5.0 or earlier, are exposed through the 'slug' parameter, which the sources say is reachable without logging in. Sites that do not run this theme are not affected. The sources do not say whether a default configuration is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4173,"output_tokens":561,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the theme vendor's changelog for a fixed version and whether a default install is exposed.","search":"'-110184':12A,15A '-2026':11A,14A '1.5.0':43B,97C 'addit':126C 'alreadi':130C 'append':61B,125C 'attack':59B,123C 'blind':83C 'content':9A 'cve':10A,13A 'data':69B 'databas':8A,74B,143C 'due':98C 'escap':54B,101C 'exist':114C,131C 'expos':7A 'extract':67B,138C 'host':23B 'includ':42B,96C 'inform':140C 'inject':6A,26B,85C 'insuffici':100C 'lack':108C 'make':118C 'newsmat':1A,18B,32B,76C 'newsmatic':16A 'newsmatic-them':17B 'paramet':47B,89C,106C 'pass':44B 'possibl':120C 'prepar':56B,111C 'proper':53B 'queri':51B,65B,116C,128C,132C 'self':22B 'self-host':21B 'sensit':68B,139C 'site':72B 'slug':46B,88C 'sql':5A,25B,50B,64B,84C,115C,127C 'sql-inject':24B 'suffici':110C 'suppli':105C 'theme':3A,19B,30B,33B,77C 'unauthent':4A,58B,122C 'use':136C 'user':104C 'version':38B,92C 'via':86C 'vulner':81C 'without':52B 'wordpress':2A,27B,29B,35B,79C 'wordpress-them':28B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites that have the Newsmatic theme installed, at version 1.5.0 or earlier, are exposed through the 'slug' parameter, which the sources say is reachable without logging in. Sites that do not run this theme are not affected. The sources do not say whether a default configuration is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T12:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110184","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110184","severity":null,"published_at":"2026-10-29T12:17:09+00:00","modified_at":"2026-10-29T12:17:09+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","fetched_at":"2026-10-29T12:24:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110184:1023","url":null,"severity":null,"published_at":"2026-10-29T12:27:52+00:00","modified_at":"2026-10-29T12:27:52+00:00","first_seen_at":"2026-10-29T12:27:52+00:00","fetched_at":"2026-10-29T12:27:52+00:00","note":"Fix 1.5.1 comes from Patchstack, which is not the vendor. WordPress.org theme page shows 1.5.2, updated 2026-10-28. The Wordfence entry and the theme changelog returned no text, so nothing is marked verified. Patchstack rates it CVSS 9.3 and expects mass exploitation, but it reports no exploitation yet, so exploited and severity are unchanged. NVD/Wordfence CVSS is 7.5, blind SQLi, no authentication needed. Patchstack has a virtual-patch rule. Confirm 1.5.1 against the theme changelog or Wordfence."}],"documents":[{"id":16420,"url":"https://patchstack.com/database/wordpress/theme/newsmatic/vulnerability/wordpress-newsmatic-theme-1-5-0-unauthenticated-sql-injection-vulnerability","title":"Patchstack: Newsmatic <= 1.5.0 unauthenticated SQL injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":16421,"url":"https://wordpress.org/themes/newsmatic/","title":"Newsmatic theme page on WordPress.org (v1.5.2, updated 2026-10-28)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}