CVE-2026-94075: WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Newsletters pluginto a version that resolves this vulnerability.Fixed in 4.18.2
Event History
Frequently Asked Questions
Which installations are affected?
Tribulant Software Newsletters installations running any affected version through 4.18.1 are affected. The available data does not identify a fixed version.
Can this be exploited remotely without authentication or user interaction?
Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the potential impact of successful exploitation?
The severity data rates the issue critical at 9.8 and indicates high impact to confidentiality, integrity, and availability.