Critical SQL Injection Vulnerability in Newsletters Lite Plugin

WordPress

What happened

A critical SQL Injection vulnerability has been identified in the Newsletters Lite plugin for WordPress that could allow attackers to execute unauthorized SQL commands.

Are you affected?

The affected software is the Newsletters Lite plugin for WordPress, specifically versions up to and including 4.18.1. You may be affected if you are running this plugin.

What to do now

1. Upgrade to a version of Newsletters Lite that is not affected. Check the official advisory for guidance on available updates.
2. Regularly monitor your website for unusual activities and vulnerabilities.
3. Consider implementing additional security measures, such as a web application firewall.

Sources

• cve.now/CVE-2026-111402
• cve.now/GHSA-6623-56rc-mrm6
• CVE-2026-111402
• GHSA-6623-56rc-mrm6
• https://nvd.nist.gov/vuln/detail/CVE-2026-111402
• https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-1-sql-injection-vulnerability?_s_id=cve
• cve.now/GHSA-6623-56RC-MRM6
• GHSA-6623-56RC-MRM6

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.