8.1
Élevée
CVE-2026-12583 The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored…
Description
The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Newsletters 4.15 | premières → < 4.15 | 4.15 |
Autres CVE de Newsletters
Les 8 CVE de Newsletters →
CVE-2026-16264
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber…
6.5
Moyenne
CVE-2026-17522
The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its…
5.4
Moyenne
CVE-2026-17520
The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source,…
4.8
Moyenne
CVE-2026-16269
The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing…
4.8
Moyenne