CVE-2026-116863: WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability

Q: Does exploitation require authentication or user interaction?

The attack vector is network-based with low complexity and requires no attacker privileges. It does require user interaction, consistent with a CSRF attack requiring a targeted user to perform an action.

Q: Which installations are affected?

The affected software is identified as Tribulant Software Newsletters Lite. Versions through 4.18.2 are affected; the earliest affected version is not specified.

Q: What is the potential security impact?

The CVSS vector indicates high potential impact to confidentiality, integrity, and availability, with scope changed. The issue is rated critical with a 9.6 severity score.

Published Oct 27, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.

Affected Software

1 affected component

Tribulant Software Newsletters Lite<=4.18.2

Event History

Oct 27, 2026

CVE Published

via MITRE·03:56 PM

Data Sourced

via MITRE·03:56 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require authentication or user interaction?

The attack vector is network-based with low complexity and requires no attacker privileges. It does require user interaction, consistent with a CSRF attack requiring a targeted user to perform an action.

Which installations are affected?

The affected software is identified as Tribulant Software Newsletters Lite. Versions through 4.18.2 are affected; the earliest affected version is not specified.

What is the potential security impact?