CVE-2026-94075
WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
The Newsletters WordPress plugin by Tribulant Software is affected by this vulnerability. An attacker could exploit the flaw to inject malicious PHP objects, potentially allowing them to run code, access or change data, or take control of the affected website.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.
Affected versions
- newsletters-lite
through 4.18.1