CVE-2026-111402
WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability
Tribulant Software Newsletters
CVSS
9.3CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
What fixes it
No source in this snapshot names a fixed version.
Reports 5
2 outlets mention it. Reports are not confirmation; each links to its source.
- @stemshop.bsky.social: 🚨 CVE-2026-111402 — CVSS 9.3 CRITICAL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribu... 🔎 https://stemshop.top/cve/CVE-Bluesky: CVE posts, 24 Oct 2026
- @stackflag.bsky.social: CVE-2026-111402 - newsletters The Newsletters plugin for WordPress (versions up to 4.18.1) lets a malicious user send specially crafted data that can cause the website’s database tBluesky: CVE posts, 24 Oct 2026
- @thehackerwire.bsky.social: 🔴 CVE-2026-111402 - Critical (9.3) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilit... https://www.thehackerwire.com/vulnerability/Bluesky: CVE posts, 24 Oct 2026
- @cve.skyfleet.blue: CVE-2026-111402 - WordPress Newsletters plugin CVE ID : CVE-2026-111402 Published : 24 octobre 2026 08:00 | 16 minutes ago Description : Improper Neutralization of Special ElementsBluesky: CVE posts, 24 Oct 2026
- 🚨 CVE-2026-111402 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue Telegram: CVE Notify, 24 Oct 2026
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.
Text from CVE List
Affected versions 1
- Newslettersaffected: all versions through 4.18.1CVE List