{"id":"CVE-2026-124265","kind":"vulnerability","aliases":["CVE-2026-124265"],"related":[],"title":"Tribulant Newsletters WordPress plugin: blind SQL injection through version 4.18.1","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.","summary":"The Newsletters Lite plugin by Tribulant Software for WordPress has an SQL injection flaw that lets an attacker alter database queries. The sources say it allows blind SQL injection, so an attacker can extract data from the site database one answer at a time.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"newsletters-lite","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["newsletters-lite","other","tribulant","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed version of the Newsletters Lite plugin (newsletters-lite) in the WordPress admin plugin list, and whether it is `4.18.1` or older.","fix":"- Newsletters (newsletters-lite): unknown, the sources give no fixed version.","status":"open","published_at":"2026-11-13T15:17:36+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","triaged_at":"2026-11-13T15:48:18+00:00","updated_at":"2026-11-13T15:48:18+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T15:48:18Z","model":"claude-haiku-5-5","output":{"fix":"- Newsletters (newsletters-lite): unknown, the sources give no fixed version.","reach":"internet","title":"Tribulant Newsletters WordPress plugin: blind SQL injection through version 4.18.1","impact":"high","summary":"The Newsletters Lite plugin by Tribulant Software for WordPress has an SQL injection flaw that lets an attacker alter database queries. The sources say it allows blind SQL injection, so an attacker can extract data from the site database one answer at a time.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","newsletters-lite","tribulant"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads site database contents, including user and password data.","analyst_note":"Confirm the fixed version and whether authentication is required, from the Tribulant or WPScan advisory for CVE-2026-124265.","how_to_check":"- Check the installed version of the Newsletters Lite plugin (newsletters-lite) in the WordPress admin plugin list, and whether it is `4.18.1` or older.\n- unknown","plain_action":"","product_name":"newsletters-lite","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the Newsletters Lite plugin by Tribulant Software at version 4.18.1 or earlier are in the stated range. The sources do not say which configurations or user roles are needed to reach the flaw, so unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4549,"output_tokens":572,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124265':13A,16A '-2026':12A,15A '4.18.1':10A,100C 'affect':95C 'allow':51B,90C 'alter':44B 'answer':66B 'attack':43B,57B 'blind':5A,52B,91C 'command':79C 'cve':11A,14A 'data':60B 'databas':45B,64B 'element':74C 'extract':59B 'flaw':39B 'improp':70C 'inject':7A,38B,54B,81C 'injection.this':93C 'issu':94C 'let':41B 'lite':19A,22B,28B,89C 'n/a':98C 'neutral':71C 'newslett':2A,21B,27B,86C,88C,96C 'newsletters':18A 'newsletters-lit':20B,87C 'newsletters-lite':17A 'one':65B 'plugin':4A,29B 'queri':46B 'say':49B 'site':63B 'softwar':32B,85C 'sourc':48B 'special':73C 'sql':6A,37B,53B,78C,80C,92C 'time':69B 'tribul':1A,24B,31B,84C 'use':75C 'version':9A 'vulner':82C 'wordpress':3A,25B,34B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Newsletters Lite plugin by Tribulant Software at version 4.18.1 or earlier are in the stated range. The sources do not say which configurations or user roles are needed to reach the flaw, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["newsletterslite"],"ptokens":["lite","newsletters"],"labels":["high","newsletterslite","other","tribulant","vendor","wordpress"],"campaign_type":null,"search_a":"'-124265':13A,16A '-2026':12A,15A '4.18.1':10A 'blind':5A 'cve':11A,14A 'inject':7A 'lite':19A 'newslett':2A 'newsletters':18A 'newsletters-lite':17A 'plugin':4A 'sql':6A 'tribul':1A 'version':9A 'wordpress':3A","search_b":"'allow':51B 'alter':44B 'answer':66B 'attack':43B,57B 'blind':52B 'data':60B 'databas':45B,64B 'extract':59B 'flaw':39B 'inject':38B,54B 'let':41B 'lite':22B,28B 'newslett':21B,27B 'newsletters-lit':20B 'one':65B 'plugin':29B 'queri':46B 'say':49B 'site':63B 'softwar':32B 'sourc':48B 'sql':37B,53B 'time':69B 'tribul':24B,31B 'wordpress':25B,34B","search_c":"'4.18.1':100C 'affect':95C 'allow':90C 'blind':91C 'command':79C 'element':74C 'improp':70C 'inject':81C 'injection.this':93C 'issu':94C 'lite':89C 'n/a':98C 'neutral':71C 'newslett':86C,88C,96C 'newsletters-lit':87C 'softwar':85C 'special':73C 'sql':78C,80C,92C 'tribul':84C 'use':75C 'vulner':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124265","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124265","severity":null,"published_at":"2026-11-13T15:17:36+00:00","modified_at":"2026-11-13T15:17:36+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","fetched_at":"2026-11-13T15:46:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}