Vulnerabilities CVE-2026-12583

CVE-2026-12583

None

Open

TLP:CLEAR

Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.

Details

EPSS Score ⓘ: 0.33%

25.3th percentile
Confidence: 90%
Published: Jul 14, 2026
Last Modified: Jul 14, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.