CVE Feed

    Dashboard / CVE / CVE-2026-12583

    CVE-2026-12583

    The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.

    Published:Jul 14, 2026
    Last Modified:Nov 10, 2026
    EPS:Jul 14, 2026
    EPSS Score:0.02027
    CVSS Score:8.1

    Affected Products

    Vendor
    Wordpress-extensions
    Product
    Newsletters

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-586 Object Injection

    Related CVEs

    CVE-2026-101325 (CVSS 5.3) — The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all v…
    CVE-2026-116863 (CVSS 9.6) — Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cros…
    CVE-2026-94075 (CVSS 9.8) — Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Obje…
    CVE-2026-111402 (CVSS 9.3) — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulan…
    CVE-2026-16264 (CVSS 6.5) — The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber m…
    CVE-2026-66619 (CVSS 7.6) — Administrator SQL Injection in Newsletters <= 4.18 versions.…
    CVE-2026-17522 (CVSS 5.4) — The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of…
    CVE-2026-17520 (CVSS 4.8) — The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source,…
    CVE-2026-16269 (CVSS 4.8) — The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing un…
    CVE-2026-16267 (CVSS 8.1) — The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High