Newsmatic - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/newsmatic/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 13:18:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNewsmatic WordPress Theme: Blind SQL Injection (CVE-2026-110184)https://feed.craftedsignal.io/briefs/2026-10-newsmatic-sql-injection/Thu, 29 Oct 2026 13:18:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-newsmatic-sql-injection/The Newsmatic theme for WordPress is vulnerable to unauthenticated blind SQL injection in the slug parameter, allowing remote attackers to extract sensitive database information.The Newsmatic theme for WordPress (versions 1.5.0 and earlier) contains a vulnerability due to improper input sanitization and lack of parameterized SQL queries. An unauthenticated attacker can exploit this via the 'slug' parameter to execute arbitrary SQL commands, leading to unauthorized database information disclosure.

Impact

Successful exploitation allows for the extraction of sensitive information from the WordPress database by an unauthenticated attacker.

Recommendation

  • Update the Newsmatic theme for WordPress to a version patched beyond 1.5.0 immediately.
  • Audit web application logs for suspicious 'slug' parameters containing SQL syntax (e.g., SELECT, UNION, SLEEP, benchmark).
  • Implement a Web Application Firewall (WAF) to detect and block SQL injection patterns targeting the 'slug' parameter.
]]>highadvisorywordpresssql-injectionweb-applicationcve-2026-110184