Newsletters Plugin SQL Injection (CVE-2026-111402): Update to 4.18.2 Now

Newsletters, by Tribulant Software, is a WordPress plugin for mailing lists, subscribe forms and email campaigns. The free version on WordPress.org (slug newsletters-lite) has more than 2,000 active installs. CVE-2026-111402, published October 24, is an SQL injection in every version up to and including 4.18.1, and the attacker doesn't need an account.

The fix has been out since October 20, in Newsletters 4.18.2. If you're on 4.18.1 or earlier, update today.

It's an SQL injection (CWE-89): the plugin puts text from a web request into a database query without making it safe first, so an attacker can add their own SQL to the query. Patchstack, which assigned the CVE, rates it CVSS 3.1 9.3 (Critical) and lists the required privilege as "Unauthenticated." Its advisory says an SQL injection like this lets attackers "read, modify, or delete the entire database — including user accounts and private data."

The score breaks down like this: network attack, low complexity, no login, no user interaction, and high impact on confidentiality. In plain terms, the main risk is someone reading data out of your database. On a newsletter plugin, that data includes your subscriber list.

The CVE record doesn't say which request is vulnerable. The 4.18.2 changelog lists one unauthenticated SQL injection fix, in "subscriber profile management," which now rejects "client-supplied subscriber IDs" and uses prepared queries. WPSec describes that bug in detail. According to WPSec, the id field on the subscriber profile form gets pasted straight into an UPDATE query, and any visitor can get the session needed to send it just by subscribing to a list. The two advisories credit different researchers, so I can't confirm they're the same bug. Either way, the fix is the same: 4.18.2.

You are if Newsletters 4.18.1 or earlier is installed and active. Check the version:

wp plugin get newsletters-lite --field=version

Or look for "Newsletters" by Tribulant Software under Plugins in the admin. The CVE covers versions "from n/a through 4.18.1," which means every release up to that one.

If you run Newsletters PRO, which you download from Tribulant instead of WordPress.org, check its version the same way. The CVE record only names the newsletters-lite package, so if your PRO version is older than 4.18.2, ask Tribulant whether it's affected and update anyway.

1. Update to Newsletters 4.18.2 or later.

wp plugin update newsletters-lite

Plugin auto-updates aren't on by default in WordPress, so don't assume it already happened. Check the version again afterward.

2. Can't update right now? Deactivate it.

wp plugin deactivate newsletters-lite

Deactivating keeps your lists and settings in the database, but the plugin's code stops running, so nobody can reach the vulnerable request. Subscribe forms will stop working until you update and turn it back on. That's a fair trade for a day. If your host or a firewall service like Patchstack offers a virtual patch for this CVE, that can help in the meantime too. Patchstack says it has issued a rule to block attacks. Treat that as a stopgap, not a fix.

3. If you don't use it, delete it. A newsletter plugin left over from an old campaign is just attack surface.

wp plugin deactivate newsletters-lite && wp plugin delete newsletters-lite

Deleting through WordPress may run the plugin's uninstall routine and remove its data, so export your subscribers first if you might want them later.

An SQL injection that only reads data doesn't leave files behind, so you won't find a neat backdoor to delete. Here's what I'd check:

1. Your access logs. Look for requests to admin-ajax.php that mention the subscriber management action WPSec names, plus common SQL injection keywords:

grep -i "managementsavefields" access.log
grep -iE "union(%20|\+|\s)+select|sleep\(|benchmark\(|information_schema" access.log

Most servers don't log POST bodies, so a clean result doesn't prove much. A burst of odd requests from one IP to admin-ajax.php is still worth noting.

2. Your admin users.

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

Anyone you don't recognize is a red flag.

3. Your subscriber records. WPSec says the bug it describes can modify other subscribers' records. Look through the plugin's subscriber list for changed emails or junk entries. Its database tables start with your prefix plus wpml, for example wp_wpmlsubscribers.

4. Rotate secrets if you were exposed. If you ran a vulnerable version with a public subscribe form, assume your database could have been read. That includes password hashes. Change admin passwords and reset the WordPress salts, which signs everyone out:

wp config shuffle-salts

If the plugin stores SMTP or mail service API credentials in its settings, rotate those too.

5. Run the full audit if anything looks off. The checks in my WordPress audit checklist after a plugin compromise cover users, plugins on disk, file checksums, cron jobs and recent PHP files.

• The scores don't agree. Patchstack's CVE says 9.3 Critical, with a "changed" scope. WPSec rates the subscriber-profile bug it describes 7.5 High. NVD hadn't added its own score yet; its status was still "Received." I'd plan around the higher number.
• No public exploitation reports yet. Patchstack calls it "expected to become exploited" and says bugs like this get used in mass-exploit campaigns that hit "thousands of websites at a time." As of October 24, CISA's assessment on the CVE record lists exploitation as "none" and automatable as "yes," and the CVE isn't on CISA's Known Exploited Vulnerabilities list. That "automatable" part is why I wouldn't wait.
• 4.18.2 fixes more than one thing. The same release also fixes an unauthenticated PHP object injection and hardens other subscriber queries. Even if you somehow weren't exposed to this CVE, the update is worth it.

Update Newsletters everywhere it's installed, and delete it anywhere it's left over from an old campaign. Newsletter plugins are a target because the subscribe form is public by design, and the list behind it is real people's contact info. If you're already going through your WordPress sites after this month's Prime Mover fix and plugin compromises, add Newsletters to the list.

If you run WordPress for a small business and want someone to check your plugins and patch them safely, that's work I take on. Get a free quote and tell me what you're running.

Which Newsletters version fixes CVE-2026-111402?

Newsletters 4.18.2, posted to WordPress.org on October 20, 2026. All versions up to and including 4.18.1 are affected.

Does an attacker need an account?

No. Patchstack lists the required privilege as unauthenticated. For the subscriber-profile bug WPSec describes, an attacker only needs the session any visitor gets by subscribing to a list.

Is CVE-2026-111402 being exploited?

No attacks had been publicly reported as of October 24, 2026, and it isn't on CISA's Known Exploited Vulnerabilities list. Patchstack expects exploitation, and CISA's assessment marks it as automatable, so update now rather than waiting for reports.

What CVSS score does CVE-2026-111402 have?

Patchstack, the CVE assigner, rates it 9.3 Critical (CVSS 3.1). WPSec rates the subscriber-profile SQL injection it describes 7.5 High. NVD hadn't published its own score yet.

What if I can't update right away?

Deactivate the plugin with wp plugin deactivate newsletters-lite or from the Plugins screen. Your subscriber data stays in the database, and you can turn it back on after you update to 4.18.2.

• Patchstack, "WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability"
• NVD, "CVE-2026-111402"
• CVE.org, "CVE-2026-111402"
• WordPress.org, "Newsletters" plugin page and changelog
• Tribulant, "Newsletters 4.18.2 Release Notes"
• WPSec, "WPSEC-2026-1337"