Newsmatic Theme EUVD-2026-112748

Exploitation requires only that the Newsmatic theme (versions up to and including 1.5.0) be installed and active on a reachable WordPress site; the attacker supplies a malicious value in the 'slug' parameter, which reaches an SQL query in functions.php that is insufficiently escaped and not properly prepared. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or non-default configuration is indicated - this is remote unauthenticated exploitation against default installations of the theme. The main limiting factors are that the target must run this specific theme at a vulnerable version, and that impact is confined to data disclosure (blind extraction) with no integrity or availability effect; upgrading to 1.5.1 removes the flaw.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated SQL injection with high confidentiality impact and no integrity or availability impact - consistent with a blind data-extraction flaw rather than full compromise. The vuln.today Decision label is 'this_week', indicating a prioritized but not emergency timeline. No EPSS score, no CISA KEV listing, and no SSVC exploitation/automatable fields were supplied, so I cannot quantify exploitation probability from the input; absence of these signals is not evidence of safety but it does argue against confirmed mass exploitation. The provided references are a Wordfence threat-intel advisory, the WordPress theme trac source lines, a trac ticket, and the fixed 1.5.1 source - these are vendor/code sources, not a weaponized exploit, so no public exploit is identified at time of analysis. Net: a genuine, easily reachable unauthenticated SQLi in a public-facing WordPress theme is a real priority worth patching this week, but the confidentiality-only impact and lack of any exploitation telemetry (EPSS/KEV/POC) keep it below drop-everything emergency status.

An unauthenticated attacker sends a crafted HTTP request to a Newsmatic-powered WordPress site, injecting SQL through the 'slug' parameter that is concatenated into an unprepared query in functions.php. Because the vector is network, low-complexity, and requires no privileges or user interaction, the attacker can blindly infer and extract database contents (such as user records or password hashes) through the injection. No public exploit code is identified in the provided data, though the mechanism is confirmed by Wordfence and the theme source.