Newsletters

Newsletters versions through 4.18.1 contain critical unauthenticated PHP object injection and SQL injection vulnerabilities. Update to 4.18.2 or later.

The Newsletters plugin by Tribulant Software contains two critical unauthenticated vulnerabilities in versions through 4.18.1. CVE-2026-94075 allows PHP object injection, while CVE-2026-111402 allows SQL injection through subscriber profile management. Both issues are fixed in version 4.18.2.

Table of Contents

Vulnerability summary

Plugin: Newsletters
Slug: newsletters-lite
Affected versions: 4.18.1 and earlier
Fixed version: 4.18.2
CVE-2026-94075: unauthenticated PHP object injection, CVSS 9.8
CVE-2026-111402: unauthenticated SQL injection, CVSS 9.3
Privileges required: None
User interaction: None
Known exploitation: No confirmed in-the-wild exploitation was identified in the reviewed sources

CVE-2026-94075: PHP object injection

The vulnerable path involves dismissal of the plugin’s database update notice. According to the vendor’s 4.18.2 changelog, the fix adds administrator authorization and a nonce, validates the submitted version, and prevents a second unserialization of the stored value. In affected releases, an unauthenticated request could introduce attacker-controlled serialized data that the plugin later unserialized.

Object injection can instantiate attacker-selected PHP objects. Further impact depends on whether a usable property-oriented programming gadget chain exists in the site’s installed code. The public advisory does not establish a specific remote-code-execution chain, so administrators should treat the flaw as critical without assuming that every site was automatically compromised.

CVE-2026-111402: SQL injection

The SQL injection affects subscriber profile management. The 4.18.2 changelog states that the patch rejects client-supplied subscriber IDs and converts the affected subscriber update queries to prepared statements. The CVSS vector indicates network access, low complexity, no privileges, and no user interaction, with high confidentiality impact.

Immediate remediation

Update Newsletters to version 4.18.2 or later.
If the update cannot be applied immediately, deactivate the plugin until a patched version is installed.
Purge page and object caches after updating.
Review access logs for unusual unauthenticated requests involving newsletter profile-management actions or update-notice dismissal.
Inspect subscriber records, administrator users, active plugins, scheduled tasks, and recently modified PHP files if suspicious activity is present.
Rotate database credentials only after preserving evidence and confirming or strongly suspecting database compromise.

Verify the installed version

wp plugin get newsletters-lite --fields=name,status,version,update,update_version
wp plugin update newsletters-lite
wp cache flush

The installed version should be 4.18.2 or later. Confirm the production site is running the patched files, especially when plugin releases are deployed from a staging environment or managed repository.

Verification and incident review

Compare subscriber and administrator changes with expected business activity. Review database and PHP logs for query errors or unserialization warnings around suspicious requests. File-integrity checks can help identify unexpected changes:

wp plugin verify-checksums newsletters-lite
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --format=table
wp cron event list --fields=hook,next_run_gmt,recurrence --format=table

A checksum warning is not proof of exploitation because premium or locally modified files may differ from WordPress.org. Investigate each difference against a trusted copy of the deployed release.