CVE-2026-111402

CVE-2026-111402 · WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.

CVSS 9.3 · Critical · EPSS 0.3% · Fix available

Published: 2026-10-24T08:00:10.963Z
Updated: 2026-10-24T14:46:59.295Z

Affected products and versions

newsletters
Versions
- ≥ 0, ≤ 4.18.1: Affected; ≥ 4.18.2: Not affected (custom)
Update to 4.18.2

Original sources

https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-1-sql-injection-vulnerability?_s_id=cve
https://nvd.nist.gov/vuln/detail/CVE-2026-111402

Check your server →