---
id: "CVE-2026-111402"
kind: "vulnerability"
aliases: ["CVE-2026-111402"]
title: "Tribulant Newsletters WordPress plugin: SQL injection through version 4.18.1"
severity: "critical"
cvss: 9.3
epss: 0.004
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["newsletters-lite", "package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "plugin-updated"]
published_at: "2026-10-24T08:16:50+00:00"
first_seen_at: "2026-10-24T08:47:15+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111402", "first_seen_at": "2026-10-24T08:47:15+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111402", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Tribulant Newsletters WordPress plugin: SQL injection through version 4.18.1

The Newsletters Lite plugin by Tribulant Software for WordPress contains an SQL injection flaw that lets input reach the database unescaped. An attacker can read or change site data, and possibly more depending on the database permissions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or inspect the `newsletters-lite` plugin header version
- Treat any installed version at or below `4.18.1` as affected

## Fix

- Update the Newsletters Lite plugin to a version later than `4.18.1`, or remove the plugin if it is not needed
- unknown for the exact patched version number

## Timeline

- 2026-10-24T08:47:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111402
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111402

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_