PT-2026-68398 · WordPress · Newsletters
CVE-2026-16268
·
Published
2026-08-06
·
Updated
2026-08-06
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Newsletters WordPress plugin versions prior to 4.16
Description
An issue exists where the plugin fails to authenticate or validate bounce-processing requests before fetching a user-supplied URL on the server side. This allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF), a technique where the server is coerced into making requests to arbitrary internal or external hosts.
Recommendations
Update the Newsletters WordPress plugin to version 4.16 or later.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Newsletters