The WordPress Newsletters Lite plugin contains a flaw where user input is not properly sanitized before being embedded in an SQL query. This vulnerability, identified as CWE‑89, allows an attacker to inject arbitrary SQL statements into the database. If successfully exploited, the attacker could potentially execute commands that read, modify, or delete data in the WordPress database, thereby affecting confidentiality, integrity, and availability of the site.

Tribulant Software Newsletters Lite plugin versions from the first release up to and including 4.9.9.7 are affected. The disclosure does not specify a lower bound, so all earlier releases should also be treated as vulnerable. The vulnerability exists in the plugin code that processes RSS feeds and mailing list subscription requests.

The CVSS base score of 7.6 indicates a high‑severity flaw. The EPSS score of less than 1% suggests that the likelihood of exploitation in the current environment is low, and the issue is not listed in the CISA KEV catalogue. The likely attack vector is remote via HTTP requests to the plugin’s exposed endpoints; no additional privileged access is required to exploit the code.