Newsletters unauthenticated PHP object injection through public date fields
Newsletters before 4.16 treats a request value for a public subscribe-form field of type pre_date as serialized data. render_field() reads the field's dynamic slug from the request and passes the value to maybe_unserialize(), causing PHP to instantiate a submitted object while rendering the form. Practical impact depends on a compatible POP or gadget chain already present in WordPress, the plugin, the theme or another plugin; no usable chain is disclosed, so code execution or destructive impact is not confirmed. The exact form URL and parameter vary by site configuration. Version 4.16 does not unserialize request-sourced date values and disallows classes when formatting stored serialized values.
- Component
- Newsletters
- Plugin slug
newsletters-lite- Affected
- < 4.16
- Safe version
4.16- Published
- Aug 08, 2026
This CVE was published Aug 08, 2026 and is one of 37 known issues for this plugin.
Update, patch or deactivate.
Update to 4.16 or later. Until updated, remove public subscribe-form date fields or disable affected forms. Do not rely on the absence of a currently known gadget chain as a safety control.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H