Newsmatic WordPress theme: Unauthenticated blind SQL injection via slug parameter
Summary
The Newsmatic theme for WordPress does not sufficiently escape the 'slug' parameter and does not use prepared SQL statements. An unauthenticated attacker can append SQL queries to existing database queries over the network. This can be used to extract sensitive information from the database, such as user accounts and password hashes, on any public site running the affected theme.
Affected
- Newsmatic theme for WordPress, all versions up to and including 1.5.0
- Default configuration: unaffected (per CNA record)
Fixed in
- Unknown. Version 1.5.1 is referenced in the CVE data, but no changelog or vendor advisory confirms the fix.
Workaround
- No vendor workaround found.
- Check whether the theme is active on any site and deactivate or replace it.
- Ask a developer to review functions.php lines 265 to 269 in version 1.5.0.
- Interim WAF rules filtering the 'slug' parameter may help, but test them carefully; no vendor guidance exists.
- Restrict database account privileges and keep current backups.
Exploitation
- Not known to be exploited in the wild at the time of research.
- CISA KEV: not listed according to a third-party tracker; CISA not checked directly.
- No public proof of concept found at the time of research.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- EPSS: 0.42 % (percentile 37).
Our recommendation
- Check now whether any public WordPress site uses Newsmatic version 1.5.0 or earlier.
- Replace or deactivate the theme where possible until a fixed version is confirmed.
- If the theme must stay, confirm the fix in version 1.5.1 against trac ticket 295677 before updating.
- Apply the workarounds above and restrict database privileges.
- Monitor web server and WAF logs for suspicious 'slug' parameter values and review database access.
- Treat this as high priority for internet-facing sites.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence record www.wordfence.com
- Trac ticket 295677 themes.trac.wordpress.org
- Newsmatic 1.5.0 functions.php (lines 265-269) themes.trac.wordpress.org
- Newsmatic 1.5.1 functions.php themes.trac.wordpress.org
- VulDB entry 428365 vuldb.com
- Strix CVE record www.strix.ai
- OffSeq threat radar entry radar.offseq.com
- Wordfence Newsmatic theme overview www.wordfence.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 11:26.
Original description (NVD)
The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD references (6)
- https://themes.trac.wordpress.org/browser/newsmatic/1.5.0/functions.php#L265
- https://themes.trac.wordpress.org/browser/newsmatic/1.5.0/functions.php#L268
- https://themes.trac.wordpress.org/browser/newsmatic/1.5.0/functions.php#L269
- https://themes.trac.wordpress.org/browser/newsmatic/1.5.1/functions.php
- https://themes.trac.wordpress.org/ticket/295677
- https://www.wordfence.com/threat-intel/vulnerabilities/id/81a503f9-3bd2-4fb8-8c3e-8d68d41f7918?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.