8.2
High
CVE-2026-16268 The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before…
Description
The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Newsletters 4.16 | earliest → < 4.16 | 4.16 |
Other CVEs of Newsletters
The 8 CVEs of Newsletters →
CVE-2026-16264
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber…
6.5
Medium
CVE-2026-17522
The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its…
5.4
Medium
CVE-2026-17520
The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source,…
4.8
Medium
CVE-2026-16269
The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing…
4.8
Medium