Newsletters CVE-2026-66619

Requires an authenticated WordPress Administrator account (PR:H) on a site running the Newsletters (Tribulant) plugin version 4.18 or earlier; the injection is reached through a plugin admin endpoint over the network with no user interaction (AV:N/AC:L/UI:N). The dominant limiting factor is the admin prerequisite: on WordPress, an Administrator can already edit plugin/theme code and query the database, so exploitation is realistic mainly for lower-trust actors in multi-admin setups, post-account-compromise scenarios, or where admin capabilities are deliberately restricted. No non-default configuration is described beyond having the vulnerable plugin installed and active.

This is a high-privilege, low-real-world-priority issue despite its 7.6 CVSS. The vendor vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L requires PR:H - i.e. an authenticated WordPress Administrator - which is the single most important limiting factor: an admin on a WordPress site is already the highest-trust role and can typically install plugins, edit theme/plugin PHP, and thereby execute arbitrary code and read the entire database through legitimate means. An admin-only SQL injection therefore adds little marginal capability over what the actor already holds, making this primarily a defense-in-depth/hardening fix rather than an exploitable trust-boundary crossing. EPSS is not provided, there is no CISA KEV listing, and no public exploit is identified - so all three exploitation-likelihood signals are absent or negative. The vendor vector is internally questionable: S:C (scope change) and C:H are defensible for SQLi that reaches the whole DB, but I:N is odd for an injection primitive that can generally modify rows, and A:L is only weakly justified. Bottom line: high nominal score, low practical risk because the prerequisite privilege already dominates the impact.

An authenticated WordPress Administrator (or an attacker who has already compromised an admin account, e.g. via phished/reused credentials) submits a crafted parameter to a vulnerable Newsletters plugin endpoint that is concatenated into a SQL query, allowing arbitrary database reads across the WordPress schema (user hashes, secrets, other tables). No public proof-of-concept is identified at time of analysis, and the required admin privilege sharply narrows the realistic attacker set to insiders or post-compromise escalation.