CVE-2026-12583: Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field
The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12583?
CVE-2026-12583 has a severity score of 93, indicating a critical vulnerability.
How do I fix CVE-2026-12583?
To fix CVE-2026-12583, upgrade the Newsletters WordPress plugin to version 4.15 or later.
What type of vulnerability is CVE-2026-12583?
CVE-2026-12583 is an unauthenticated PHP object injection vulnerability.
Who is affected by CVE-2026-12583?
Users of the Newsletters WordPress plugin version prior to 4.15 are affected by CVE-2026-12583.
Can CVE-2026-12583 be exploited remotely?
Yes, CVE-2026-12583 can be exploited remotely by unauthenticated attackers.