CVE-2026-41555: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Weblizar – WordPress Themes & Plugin Newsletter Subscription Form – User Subscriptions Form, Capture Email

This vulnerability (CVE-2026-41555) involves improper neutralization of special elements used in an SQL command (CWE-89) within the Newsletter Subscription Form – User Subscriptions Form, Capture Email component of Weblizar WordPress themes and plugins. It allows unauthenticated attackers to perform SQL Injection attacks, which can compromise the confidentiality of the database. The CVSS v3.1 score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. The affected versions are up to 1.5.9 inclusive. No patch or vendor advisory is provided, so patch status is unknown.

An unauthenticated attacker can exploit this SQL Injection vulnerability to access or extract sensitive database information, resulting in a high confidentiality impact. The vulnerability does not affect data integrity but may cause limited availability issues. Because no privileges or user interaction are required, the attack surface is broad. The scope change indicates that the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the affected Newsletter Subscription Form component to prevent exploitation.