CVE-2026-16267 — Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field

CVE-2026-16267

Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field PUBLISHED

Description (CNA)

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.

Affected (CNA)

Vendor / product	Versions
Unknown / Newsletters	affected 0 before 4.16

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/b51c11d6-5bfa-4b2c-b348-cda19889deee/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.