CVE-2026-124265: WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

Q: Which installations are affected?

Tribulant Software Newsletters installations running version 4.18.1 or earlier are affected. The available data does not identify a safe fixed version.

Q: What level of access does an attacker need?

The CVSS vector indicates low privileges are required (PR:L), while network access is sufficient and no user interaction is required. This is a blind SQL injection issue.

Q: What is the likely impact of successful exploitation?

The supplied severity data rates confidentiality impact as high and availability impact as low. It also indicates the vulnerability can affect resources beyond the vulnerable component’s original security scope (S:C).

Published Nov 13, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.

Affected Software

1 affected component

Tribulant Software Newsletters<=4.18.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.18.2

Event History

Nov 13, 2026

CVE Published

via MITRE·03:08 PM

Data Sourced

via MITRE·03:08 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Tribulant Software Newsletters installations running version 4.18.1 or earlier are affected. The available data does not identify a safe fixed version.

What level of access does an attacker need?

The CVSS vector indicates low privileges are required (PR:L), while network access is sufficient and no user interaction is required. This is a blind SQL injection issue.

What is the likely impact of successful exploitation?

The supplied severity data rates confidentiality impact as high and availability impact as low. It also indicates the vulnerability can affect resources beyond the vulnerable component’s original security scope (S:C).

CVE-2026-124265: WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?

What is the likely impact of successful exploitation?