WordPress Plugin Vulnerabilities

Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field

Description

The plugin does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.

Proof of Concept

Affects Plugins

Plugin icon
newsletters-lite
Fixed in 4.16

References

CVE
CVE-2026-16267

Classification

Type
OBJECT INJECTION
OWASP top 10
A8: Insecure Deserialization
CWE
CWE-502
CVSS
8.1 (high)

Miscellaneous

Original Researcher
Sai Praneeth Koti
Submitter
Sai Praneeth Koti
Verified
Yes
WPVDB ID
b51c11d6-5bfa-4b2c-b348-cda19889deee

Timeline

Publicly Published
2026-08-03 (about 26 days ago)
Added
2026-08-03 (about 25 days ago)
Last Updated
2026-08-27 (about 1 day ago)

Other

Published
Title
Published
2024-11-22
Title
FluentSMTP < 2.2.83 - Unauthenticated PHP Object Injection
Published
2025-08-27
Title
Small Package Quotes – USPS Edition < 1.3.10 - Authenticated (Administrator+) PHP Object Injection
Published
2026-06-17
Title
BookingPress < 1.5.6 - Unauthenticated PHP Object Injection
Published
2025-08-19
Title
ThemeMakers Visual Content Composer <= 1.5.8 - Unauthenticated PHP Object Injection
Published
2026-08-22
Title
PPWP – Password Protect Pages < 1.9.19 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles