CVE-2026-16267: Unknown Newsletters

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.

Affected products

• Unknown Newsletters: before 4.16 (fixed in 4.16)

Published 2026-08-08. Last modified 2026-08-26.