---
id: "CVE-2026-110184"
kind: "vulnerability"
aliases: ["CVE-2026-110184"]
title: "Newsmatic WordPress theme: unauthenticated SQL injection exposes database contents"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "newsmatic", "fixed": ["1.5.1"], "affected": "<= 1.5.0", "ecosystem": "wordpress-theme"}]
ecosystems: []
tags: ["newsmatic-theme", "other", "self-hosted", "sql-injection", "wordpress", "wordpress-theme"]
not_affected_if: ["managed-hosting-with-waf", "newer-version", "newsmatic-not-installed", "theme-not-installed", "version-1.5.1-or-later"]
published_at: "2026-10-29T12:17:09+00:00"
first_seen_at: "2026-10-29T12:24:38+00:00"
updated_at: "2026-10-29T12:27:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110184", "first_seen_at": "2026-10-29T12:24:38+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T12:27:52+00:00"}]
---

# Newsmatic WordPress theme: unauthenticated SQL injection exposes database contents

The Newsmatic theme for WordPress, in all versions up to and including 1.5.0, passes the 'slug' parameter into a SQL query without proper escaping or preparation. An unauthenticated attacker can append their own SQL queries and extract sensitive data from the site's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:newsmatic affected <= 1.5.0 fixed 1.5.1

## How to check

In WordPress admin go to Appearance > Themes and check the Newsmatic version, or read the Version line in wp-content/themes/newsmatic/style.css. Versions 1.5.0 and earlier are vulnerable. Child themes of Newsmatic inherit the parent's code, so check the parent too. With WP-CLI: wp theme list --name=newsmatic --fields=name,version,status.

## Fix

Update the Newsmatic theme to 1.5.1 or later (WordPress.org currently lists 1.5.2). Patchstack names 1.5.1 as the patched version.

## Timeline

- 2026-10-29T12:24:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110184
- 2026-10-29T12:27:52+00:00 analyst — Fix 1.5.1 comes from Patchstack, which is not the vendor. WordPress.org theme page shows 1.5.2, updated 2026-10-28. The Wordfence entry and the theme changelog returned no text, so nothing is marked verified. Patchstack rates it CVSS 9.3 and expects mass exploitation, but it reports no exploitation yet, so exploited and severity are unchanged. NVD/Wordfence CVSS is 7.5, blind SQLi, no authentication needed. Patchstack has a virtual-patch rule. Confirm 1.5.1 against the theme changelog or Wordfence.

## Documents

- [advisory] Patchstack: Newsmatic <= 1.5.0 unauthenticated SQL injection https://patchstack.com/database/wordpress/theme/newsmatic/vulnerability/wordpress-newsmatic-theme-1-5-0-unauthenticated-sql-injection-vulnerability
- [fix] Newsmatic theme page on WordPress.org (v1.5.2, updated 2026-10-28) https://wordpress.org/themes/newsmatic/

## From the sources

The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_