CVE-2026-12583
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Newsletters WordPress plugin before version 4.15 fails to prevent deserialization of untrusted input submitted via a public form. This allows unauthenticated attackers to inject a PHP object and, through a property-oriented gadget chain, write arbitrary files and execute code on the server.
Risk Assessment
An attacker can take over the server, steal data, or install malware without requiring authentication.
Recommendation
Immediately update the Newsletters plugin to version 4.15 or later. If updating is not possible, temporarily disable the plugin.
Other vulnerabilities in Newsletters WordPress plugin
See all- CVE-2026-16264Medium
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request. This allows attackers to read any subscriber's personal data and overwrite any subscriber's record, including their email address.
- CVE-2026-16268High
The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side. This allows unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.
Original NVD description (English source)
The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS