{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-110184/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:newsmatic:newsmatic:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-110184"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Newsmatic (\u003c= 1.5.0)"],"_cs_severities":["high"],"_cs_tags":["wordpress","sql-injection","web-application","cve-2026-110184"],"_cs_type":"advisory","_cs_vendors":["Newsmatic"],"content_html":"\u003cp\u003eThe Newsmatic theme for WordPress (versions 1.5.0 and earlier) contains a vulnerability due to improper input sanitization and lack of parameterized SQL queries. An unauthenticated attacker can exploit this via the 'slug' parameter to execute arbitrary SQL commands, leading to unauthorized database information disclosure.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the extraction of sensitive information from the WordPress database by an unauthenticated attacker.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Newsmatic theme for WordPress to a version patched beyond 1.5.0 immediately.\u003c/li\u003e\n\u003cli\u003eAudit web application logs for suspicious 'slug' parameters containing SQL syntax (e.g., SELECT, UNION, SLEEP, benchmark).\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) to detect and block SQL injection patterns targeting the 'slug' parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T13:18:01Z","date_published":"2026-10-29T13:18:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-newsmatic-sql-injection/","summary":"The Newsmatic theme for WordPress is vulnerable to unauthenticated blind SQL injection in the slug parameter, allowing remote attackers to extract sensitive database information.","title":"Newsmatic WordPress Theme: Blind SQL Injection (CVE-2026-110184)","url":"https://feed.craftedsignal.io/briefs/2026-10-newsmatic-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-110184","version":"https://jsonfeed.org/version/1.1"}