CVE-2026-12583

Name of the Vulnerable Software and Affected Versions Newsletters WordPress plugin versions prior to 4.15

Description An issue exists where the software fails to prevent the deserialization of untrusted input submitted through a public form. This allows unauthenticated attackers to inject a PHP object and utilize a property-oriented gadget chain—a sequence of existing code fragments used to achieve an unintended goal—to write arbitrary files and execute code on the server.

Recommendations Update Newsletters WordPress plugin to version 4.15 or later.