SQL Injection Flaw in Tribulant Software Newsletters Plugin
CVE-2026-111402

9.3CRITICAL

Key Information:

Vendor

WordPress
Status
Newsletters
Vendor
CVE Published:
24 October 2026

What is CVE-2026-111402?

An SQL Injection vulnerability exists in the Tribulant Software Newsletters Lite plugin, which can allow attackers to manipulate database queries. This flaw affects versions up to 4.18.1, potentially allowing unauthorized access to sensitive information and manipulation of database contents. Proper mitigation strategies should be employed to ensure web applications utilizing this plugin are secured against exploitation.

Affected Version(s)

Newsletters 0 <= 4.18.1

References

https://patchstack.com/database/wordpress/plugin/newslett...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Noverdi Anugrah Ramadhan | Patchstack Bug Bounty Program
.