CVE-2026-16267 PUBLISHED

Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field

Assigner: WPScan
Reserved: 20.07.2026 Published: 08.08.2026 Updated: 08.08.2026

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.

Product Status

Vendor Unknown
Product Newsletters
Versions Default: unaffected
  • affected from 0 to 4.16 (excl.)

Credits

  • Sai Praneeth Koti finder
  • WPScan coordinator

References

Problem Types

  • CWE-502 Deserialization of Untrusted Data CWE