External risk intelligence

Tribulant Newsletters SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-111402

The vulnerability exists in a WordPress newsletter plugin. Such plugins are designed to manage public-facing subscription forms and mailing lists, which are inherently exposed to the public internet to facilitate user interaction and data collection in standard web deployments.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in the Tribulant Software Newsletters product, specifically within its SQL command processing. This vulnerability could allow unauthorized access to or manipulation of data. The main concern is confirming if this product is in use within our environment.

Flaw allows unauthorized access to data.
Critical flaw in popular newsletter software.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could target the Newsletters Lite plugin via the internet without needing any special access. By sending specially crafted data to the plugin, an attacker could trick it into executing unintended SQL commands. If successful, this could allow them to access or manipulate sensitive data.

No special access needed.
Malicious input to plugin.
Data compromise and potential disruption.

Live Threat

Current exploitation, exposure, and threat context

A critical SQL injection vulnerability in the Tribulant Software Newsletters plugin could allow an unauthenticated attacker to access or manipulate sensitive database information. This could occur when the plugin is deployed in a standard web environment where its subscription forms are publicly accessible. The extent of data exposure or system modification depends on the attacker's skill and the database's structure.

Sensitive database information could be exposed.
Via specially crafted network requests to the plugin.
Unauthorized database access or data alteration.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in Tribulant Software's Newsletters plugin requires immediate attention from platform and security teams. The first practical move is to inventory all instances of the affected plugin, confirm their internet reachability and business criticality, identify the accountable application or platform owner, and then prioritize remediation based on assessed risk and potential impact.

Platform and security teams own triage.
Verify plugin presence and reachability.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Tribulant Newsletters plugin?

Newsletters (also known as Newsletters Lite) is a WordPress plugin designed to manage email subscription lists and automated messaging campaigns. It enables site administrators to collect user information and deploy newsletters directly through their content management system, typically integrating with the site's public-facing forms to capture new subscriber data.

What does SQL injection mean for CVE-2026-111402?

This vulnerability, classified as CWE-89, happens when software fails to properly sanitize user-supplied data before including it in a database query. In the context of this CVE, it means an attacker can input specially formatted text into the plugin that the database interprets as a command, potentially allowing them to bypass normal security boundaries to view or modify sensitive records.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending crafted network requests directly to the plugin's inputs, such as subscription forms. The vulnerability relies on the plugin processing these requests incorrectly. It is not triggered by standard, legitimate user activity like signing up for a newsletter with a normal email address; it requires intentional, malicious data designed to exploit the database query logic.

Is my site at risk with CVE-2026-111402?

If you are using an affected version of the Newsletters plugin on a site connected to the internet, you should consider the risk significant. Halo Surface Signal identifies this as a 'Likely' concern because these plugins are purposefully built to be exposed to public visitors to gather mailing list data, making them inherently reachable from the outside without requiring any prior authentication.

What steps should I take if I use this plugin?

Start by identifying every WordPress instance in your environment where this plugin is active. Once you have a complete inventory, verify the plugin's version to see if it falls within the affected range. Coordinate with your platform owners to prioritize updating or isolating these instances based on the sensitivity of the data managed by the plugin and the site's business importance.

References

patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerabil…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.