CVE-2026-12583: Unknown Newsletters

High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days.

The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.

Affected products

• Unknown Newsletters: before 4.15 (fixed in 4.15)

Published 2026-07-14. Last modified 2026-07-14.