The vulnerability in the Tribulant Software Newsletters plugin allows an attacker to craft input that is incorporated directly into an SQL query without proper sanitization. An attacker can execute arbitrary SQL commands, which may result in disclosure of sensitive data, modification, or deletion of database records. This flaw falls under CWE‑89 and can lead to total loss of database confidentiality and integrity if exploited.

Affected are all installations of the WordPress Newsletters Lite plugin version 4.18.1 and earlier, including all sites that have not yet applied the 4.18.2 release. The plugin is supplied by Tribulant Software and embedded within WordPress sites.

With a CVSS score of 9.3, the vulnerability is rated critical. The EPSS score is not available, but the lack of a KEV listing indicates no public exploit data yet. The attack vector is likely remote, as the vulnerable input is submitted via standard WordPress administrative forms and can be accessed by any authenticated user with sufficient privileges. Exploitation requires only sending crafted SQL payloads through the plugin’s input fields; no special conditions are stated. The high severity combined with the ease of remote exploitation makes the risk substantial.