WordPress Plugin Vulnerabilities

Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler

Description

The plugin does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.

Proof of Concept

Affects Plugins

Plugin icon
newsletters-lite
Fixed in 4.16

References

CVE
CVE-2026-16268

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Yaswanth Reddy Sunkara
Submitter
Yaswanth Reddy Sunkara
Verified
Yes
WPVDB ID
65612dd4-83d8-40c5-8e12-862e9b5f940b

Timeline

Publicly Published
2026-07-30 (about 7 days ago)
Added
2026-07-30 (about 6 days ago)
Last Updated
2026-07-30 (about 6 days ago)

Other

Published
Title
Published
2024-04-03
Title
Import WP < 2.13.1 - Admin+ Server-side Request Forgery
Published
2025-11-18
Title
Icon List Block – Add Icon-Based Lists with Custom Styles < 1.2.2 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2023-11-06
Title
WPB Show Core <= 2.2 - Unauthenticated Server Side Request Forgery
Published
2025-07-01
Title
Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery
Published
2025-08-18
Title
Ditty < 3.1.58 - Unauthenticated SSRF