Unknown Newsletters vulnerabilities
8 vulnerabilities
Known vulnerabilities in Unknown Newsletters, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2026-16267unknown · newsletters +1 moreNewsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form FieldThe Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.EPSS0.45%MediumCVE-2026-16264unknown · newsletters +1 moreNewsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDORThe Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address.EPSS0.19%HighCVE-2026-16269unknown · newsletters +1 moreNewsletters < 4.16 - Unauthenticated API Authentication Bypass via Type JugglingThe Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled.EPSS0.36%HighCVE-2026-16268unknown · newsletters +1 moreNewsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce HandlerThe Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.EPSS0.73%MediumCVE-2026-17520unknown · newsletters +1 moreNewsletters < 4.17 - Unauthenticated API Access via Predictable API KeyThe Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails, when the optional API has been enabled.EPSS0.12%MediumCVE-2026-17522unknown · newsletters +1 moreNewsletters < 4.17 - Arbitrary Plugin Option Update via CSRFThe Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.EPSS0.09%HighCVE-2026-12583unknown · newsletters +1 moreNewsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom FieldThe Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.EPSS0.55%HighCVE-2023-4797tribulant · newsletters +2 moreNewsletter Lite < 4.9.3 - Admin+ Command InjectionThe Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.EPSS0.96%