{"id":"CVE-2026-111402","kind":"vulnerability","aliases":["CVE-2026-111402"],"related":[],"title":"Tribulant Newsletters WordPress plugin: SQL injection through version 4.18.1","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.","summary":"The Newsletters Lite plugin by Tribulant Software for WordPress contains an SQL injection flaw that lets input reach the database unescaped. An attacker can read or change site data, and possibly more depending on the database permissions.","severity":"critical","cvss":9.3,"epss":0.004,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["newsletters-lite","package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or inspect the `newsletters-lite` plugin header version\n- Treat any installed version at or below `4.18.1` as affected","fix":"- Update the Newsletters Lite plugin to a version later than `4.18.1`, or remove the plugin if it is not needed\n- unknown for the exact patched version number","status":"open","published_at":"2026-10-24T08:16:50+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","triaged_at":"2026-10-25T02:59:44+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T02:59:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Newsletters Lite plugin to a version later than `4.18.1`, or remove the plugin if it is not needed\n- unknown for the exact patched version number","reach":"internet","title":"Tribulant Newsletters WordPress plugin: SQL injection through version 4.18.1","impact":"high","summary":"The Newsletters Lite plugin by Tribulant Software for WordPress contains an SQL injection flaw that lets input reach the database unescaped. An attacker can read or change site data, and possibly more depending on the database permissions.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","newsletters-lite","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads or alters site database contents through injected SQL","analyst_note":"Check the NVD entry and Wolfpack or WPScan advisories for the patched version, whether auth is needed, and the affected endpoint.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or inspect the `newsletters-lite` plugin header version\n- Treat any installed version at or below `4.18.1` as affected","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated"],"who_is_affected":"Sites running the Newsletters Lite plugin (newsletters-lite) from Tribulant Software on WordPress at version 4.18.1 or earlier. The sources do not say whether authentication is required or which endpoints are reachable, so assume any site with the plugin active is exposed until updated.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000626,"input_tokens":3311,"output_tokens":589,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-111402':12A,15A '-2026':11A,14A '4.18.1':9A,93C 'affect':88C 'allow':84C 'attack':49B 'chang':53B 'command':73C 'contain':36B 'cve':10A,13A 'data':55B 'databas':46B,62B 'depend':59B 'element':68C 'flaw':40B 'host':22B 'improp':64C 'inject':6A,39B,75C 'injection.this':86C 'input':43B 'issu':87C 'let':42B 'lite':18B,29B,83C 'n/a':91C 'neutral':65C 'newslett':2A,17B,28B,80C,82C,89C 'newsletters-lit':16B,81C 'packag':19B 'permiss':63B 'plugin':4A,26B,30B 'possibl':57B 'reach':44B 'read':51B 'self':21B 'self-host':20B 'site':54B 'softwar':33B,79C 'special':67C 'sql':5A,38B,72C,74C,85C 'tribul':1A,32B,78C 'unescap':47B 'use':69C 'version':8A 'vulner':76C 'wordpress':3A,23B,25B,35B 'wordpress-plugin':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Newsletters Lite plugin (newsletters-lite) from Tribulant Software on WordPress at version 4.18.1 or earlier. The sources do not say whether authentication is required or which endpoints are reachable, so assume any site with the plugin active is exposed until updated.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T08:16:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111402","severity":null,"published_at":"2026-10-24T08:16:50+00:00","modified_at":"2026-10-24T08:16:50+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","fetched_at":"2026-10-24T08:47:15+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111402","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111402","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}