{"id":"CVE-2026-111402","published":"2026-10-24T08:16:50.877","lastModified":"2026-10-26T13:41:11.497","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-1-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"SQL injection flaw in Tribulant Newsletters Lite plugin (v4.18.1 and earlier) allows unauthenticated attackers to manipulate database queries via unsanitized user input.","exploitability":"Exploitation is straightforward for remote attackers due to lack of authentication, minimal complexity, and no user interaction required.","blast_radius":"Successful exploitation could lead to full compromise of confidentiality (data exfiltration) and partial availability impact (e.g., denial-of-service via malformed queries), though integrity remains unaffected per CVSS.","remediation":"Upgrade to Newsletters Lite version 4.18.2 or later, where the SQL injection vulnerability has been patched.","detection":"Look for HTTP requests containing suspicious SQL patterns (e.g., UNION SELECT, OR 1=1) in query parameters targeting the newsletters-lite plugin endpoints; WAF logs or web server access logs may show such anomalies.","tags":["sql-injection","web","no-auth","low-complexity","confidentiality-impact"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:49:16.941Z"}}