CVE-2026-110184

{
  "etk_id": "ETK-2026-2966",
  "cve_id": "CVE-2026-110184",
  "display_id": "CVE-2026-110184",
  "ghsa_id": "GHSA-6q9h-7wxq-r23j",
  "euvd_id": "EUVD-2026-112748",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Blind SQL injection in Newsmatic WordPress theme",
  "summary": "Newsmatic for WordPress through version 1.5.0 is affected by blind SQL injection in handling of a slug parameter. An unauthenticated remote attacker may use the flaw to obtain sensitive information from the WordPress database.",
  "mitigation": "Update Newsmatic to a vendor release newer than 1.5.0 if one is available and verified to address this issue. Until then, restrict public access to affected WordPress sites or disable the affected theme where feasible.",
  "vendor": "blazethemes",
  "product": "Newsmatic",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.5.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Newsmatic",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.023038816666666666,
  "t0_at": "2026-10-29T11:27:15.602000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-29T11:44:10.435060+00:00",
      "days": 0.01174575300925926,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T11:27:15.602000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-29T11:27:15.602000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T11:27:15.602000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110184"
    }
  }
}