CVE-2026-119616: Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name

Q: Who can exploit this issue?

Unauthenticated visitors can submit a malicious value through the public Manage Preferences page. That page provides a nonce to unauthenticated users, so the nonce does not provide an effective authorization barrier.

Q: Does an attacker need to trigger newsletter delivery themselves?

No. The attacker can store the payload in their subscriber first_name, but it is executed only when a site administrator later sends a newsletter. Administrator action is therefore required for successful exploitation.

Q: What conditions make the impact more severe?

The issue can include and execute PHP files present on the server. It can lead to code execution when PHP file types can be uploaded and then included; it may also expose sensitive data or bypass access controls.

Q: How can administrators assess whether they may be targeted?

Review subscriber first_name values, particularly entries submitted through the public Manage Preferences page, for suspicious merge-tag content involving the_template_path. Because execution occurs during newsletter sending, treat suspicious subscriber data as potentially dangerous before sending newsletters.

Published Nov 7, 2026

Updated

The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptinfields[firstname]' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The public Manage Preferences page issues a nonce to unauthenticated visitors, meaning there is no effective authorization barrier — an unauthenticated attacker can store the malicious payload as their firstname and have it executed the next time any newsletter is sent by the site operator. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

Event History

Nov 7, 2026

CVE Published

via MITRE·02:29 AM

Data Sourced

via MITRE·02:29 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated visitors can submit a malicious value through the public Manage Preferences page. That page provides a nonce to unauthenticated users, so the nonce does not provide an effective authorization barrier.

Does an attacker need to trigger newsletter delivery themselves?

No. The attacker can store the payload in their subscriber first_name, but it is executed only when a site administrator later sends a newsletter. Administrator action is therefore required for successful exploitation.

What conditions make the impact more severe?

The issue can include and execute PHP files present on the server. It can lead to code execution when PHP file types can be uploaded and then included; it may also expose sensitive data or bypass access controls.

How can administrators assess whether they may be targeted?

Review subscriber first_name values, particularly entries submitted through the public Manage Preferences page, for suspicious merge-tag content involving the_template_path. Because execution occurs during newsletter sending, treat suspicious subscriber data as potentially dangerous before sending newsletters.

CVE-2026-119616: Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name

Event History

Frequently Asked Questions

Who can exploit this issue?

Does an attacker need to trigger newsletter delivery themselves?

What conditions make the impact more severe?

How can administrators assess whether they may be targeted?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Does an attacker need to trigger newsletter delivery themselves?

What conditions make the impact more severe?

How can administrators assess whether they may be targeted?