CVE-2026-111402— WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability
Quick assessment
Affected
Tribulant Software Newsletters
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Tribulant Software 的 Newsletters 插件（newsletters-lite）中存在“SQL 命令中特殊元素未正确中和（SQL 注入）”漏洞，可导致 SQL 注入攻击。该问题影响 Newsletters 插件的以下版本：从未知版本（n/a）至 4.18.1。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111402
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Tribulant Software | Newsletters | 0 ~ 4.18.1 | - |
|
II. Public POCs for CVE-2026-111402
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111402
请登录查看更多情报信息。
Vendor Pages for CVE-2026-111402 (1)
IV. Related Vulnerabilities
Same product: Newsletters
-
CVE-2026-94075
WordPress Newsletters plugin <= 4.18.1 - PHP Object Injectio -
CVE-2026-16264
Newsletters < 4.18.1 - Unauthenticated Subscriber Record Ove -
CVE-2026-66619
WordPress Newsletters plugin <= 4.18 - SQL Injection vulnera -
CVE-2026-17520
Newsletters < 4.17 - Unauthenticated API Access via Predicta -
CVE-2026-17522
Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF
Same vendor: Tribulant Software
-
CVE-2026-94075
WordPress Newsletters plugin <= 4.18.1 - PHP Object Injectio -
CVE-2026-66619
WordPress Newsletters plugin <= 4.18 - SQL Injection vulnera -
CVE-2026-57394
WordPress Newsletters plugin <= 4.14 - Cross Site Scripting -
CVE-2026-57645
WordPress Newsletters plugin <= 4.13 - Broken Access Control -
CVE-2026-54840
WordPress Newsletters plugin <= 4.13 - Broken Access Control
Same weakness: CWE-89
-
CVE-2026-112866
WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Inject -
CVE-2026-46531
Cacti: Authenticated Stored 2nd-Order SQL Injection in autom -
CVE-2026-55465
Goobi viewer: Solr injection via unvalidated region paramete -
CVE-2026-114621
baserCMS: SQL injection in the admin panel and admin API -
CVE-2026-112837
WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerab
V. Comments for CVE-2026-111402
No comments yet