---
id: "CVE-2026-124265"
page: "https://infrastack.ai/live/CVE-2026-124265"
kind: "vulnerability"
aliases: ["CVE-2026-124265"]
title: "Tribulant Newsletters WordPress plugin: blind SQL injection through version 4.18.1"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "newsletters-lite", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["newsletters-lite", "other", "tribulant", "wordpress"]
not_affected_if: []
published_at: "2026-11-13T15:17:36+00:00"
first_seen_at: "2026-11-13T15:46:16+00:00"
updated_at: "2026-11-13T15:48:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124265", "first_seen_at": "2026-11-13T15:46:16+00:00"}]
exploit_sources: []
---

# Tribulant Newsletters WordPress plugin: blind SQL injection through version 4.18.1

Link for people: https://infrastack.ai/live/CVE-2026-124265 (this .md is for agents)

The Newsletters Lite plugin by Tribulant Software for WordPress has an SQL injection flaw that lets an attacker alter database queries. The sources say it allows blind SQL injection, so an attacker can extract data from the site database one answer at a time.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:newsletters-lite affected range not listed fixed no fixed version listed

## How to check

- Check the installed version of the Newsletters Lite plugin (newsletters-lite) in the WordPress admin plugin list, and whether it is `4.18.1` or older.

## Fix

- Newsletters (newsletters-lite): unknown, the sources give no fixed version.

## Timeline

- 2026-11-13T15:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124265

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_