CVE-2026-119616

Name of the Vulnerable Software and Affected Versions Noptin – Newsletter, New Post Notifications & Email Automation versions prior to 4.4.4

Description Local File Inclusion occurs via the noptin fields[first name] parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, enabling the execution of PHP code. This can lead to bypassed access controls, theft of sensitive data, or full code execution if .php files can be uploaded. The Manage Preferences page provides a nonce to unauthenticated visitors, removing authorization barriers. An attacker can store a malicious payload in the first name variable, which is then executed when the site operator sends a newsletter. Exploitation requires an administrator to trigger the newsletter sending process.

Recommendations Update to version 4.4.4 or later. Avoid using the noptin fields[first name] parameter until the update is applied.