CVE-2026-16268

HighCVSS 8.2

Published: 06/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

36th percentile - higher than 36% of all known CVEs

Summary

The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side. This allows unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.

Risk Assessment

An attacker can use the server to scan internal networks or attack external systems, potentially leading to security breaches and reputational damage.

Recommendation

Update the Newsletters plugin to the latest version that includes the fix. Additionally, restrict access to the bounce-processing functionality to authenticated users only.

Other vulnerabilities in Newsletters WordPress plugin

CVE-2026-12583High
The Newsletters WordPress plugin before version 4.15 fails to prevent deserialization of untrusted input submitted via a public form. This allows unauthenticated attackers to inject a PHP object and, through a property-oriented gadget chain, write arbitrary files and execute code on the server.

Original NVD description (English source)

The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.