CVE-2026-16267

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.27% chance of exploitation in the next 30 days, 19th percentile

Published

2026-08-08

Updated

2026-08-11

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/b51c11d6-5bfa-4b2c-b348-cda19889deee/

References

• CVE Record
• NVD entry

Related

• CVE-2026-16265
• CVE-2026-16268
• CVE-2026-16263
• CVE-2026-16269
• CVE-2026-16262
• CVE-2026-16273