Tribulant Newsletters CVE-2026-111402

The description states only that Newsletters (newsletters-lite) versions from n/a through 4.18.1 are affected by SQL injection; the exact vulnerable parameter, endpoint, or feature that triggers the injection is not described in the available sources. The supplied CVSS vector (PR:N, UI:N) indicates no authentication and no user interaction, implying exploitation against a default installation of the plugin, but whether any specific plugin configuration or a required privilege level applies cannot be confirmed from the single Patchstack reference. Limiting factors: exploitation requires the Newsletters plugin to be installed and at version 4.18.1 or earlier on a reachable WordPress site; the precise injection vector is unverified.

Signals mostly align toward elevated priority but rest on a single source. The Patchstack-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, which combined with the vuln.today 'act_now' decision label argues for prompt patching. However, several decision signals are MISSING: no EPSS probability, no SSVC exploitation/automatable/technical-impact breakdown, and no CISA KEV listing are present in the input, so exploitation likelihood cannot be quantified. There is no public exploit identified at time of analysis - the only reference is a Patchstack advisory, not proof-of-concept code. The CVSS also contains an internally unusual combination (S:C and A:L with I:N) for a classic read-oriented SQLi; scope-changed and availability-impact ratings should be verified against the vendor advisory. In short, this is a credibly high-severity unauthenticated SQLi in a WordPress plugin that warrants action per the act_now label, but the real-world exploitation signal (EPSS/KEV/POC) is absent rather than confirmed, so urgency derives from severity and the decision label, not from evidence of active exploitation.

A remote attacker sends crafted input to a vulnerable parameter in the Newsletters (newsletters-lite) plugin on a WordPress site running version 4.18.1 or earlier, injecting SQL that is executed against the site database. Because the supplied CVSS vector is PR:N, no authentication is indicated, and the attacker can read sensitive database contents such as user records and password hashes. No public exploit code is identified at time of analysis; the only reference is a Patchstack advisory.