{"id":"CVE-2026-116863","kind":"vulnerability","aliases":["CVE-2026-116863"],"related":[],"title":"Newsletters Lite WordPress plugin: CSRF flaw lets attackers act as admins","description":"Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.","summary":"The Newsletters Lite WordPress plugin from Tribulant Software has a cross-site request forgery flaw in versions through 4.18.2. A logged-in administrator who visits a malicious page could be tricked into making changes to the plugin's settings or data without knowing.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["newsletters-lite","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of Newsletters Lite in the WordPress admin plugins list, or run `wp plugin get newsletters-lite --field=version`\n- Confirm whether the plugin is active on the site","fix":"- Update Newsletters Lite to a version later than `4.18.2`, as published by the vendor (fixed version unknown from sources)","status":"open","published_at":"2026-10-27T16:17:30+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:33:55+00:00","updated_at":"2026-10-27T16:33:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T16:33:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update Newsletters Lite to a version later than `4.18.2`, as published by the vendor (fixed version unknown from sources)","reach":"internet","title":"Newsletters Lite WordPress plugin: CSRF flaw lets attackers act as admins","impact":"medium","summary":"The Newsletters Lite WordPress plugin from Tribulant Software has a cross-site request forgery flaw in versions through 4.18.2. A logged-in administrator who visits a malicious page could be tricked into making changes to the plugin's settings or data without knowing.","category":"package","nicknames":[],"who_cares":["wordpress","newsletters-lite","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker changes plugin settings or data as a logged-in administrator","analyst_note":"Check the NVD entry and the Tribulant advisory for the fixed version and the exact vulnerable actions.","how_to_check":"- Check the installed version of Newsletters Lite in the WordPress admin plugins list, or run `wp plugin get newsletters-lite --field=version`\n- Confirm whether the plugin is active on the site","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"WordPress sites running the Newsletters Lite plugin at version 4.18.2 or earlier are exposed. Risk is highest where administrators stay logged in while browsing other sites. Sites without the plugin installed can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000606,"input_tokens":3311,"output_tokens":550,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-116863':14A,17A '-2026':13A,16A '4.18.2':45B,96C 'act':9A 'admin':11A 'administr':50B 'affect':91C 'allow':85C 'attack':8A 'chang':61B 'could':56B 'cross':37B,72C,86C 'cross-sit':36B,71C 'csrf':5A,76C 'cve':12A,15A 'data':68B 'flaw':6A,41B 'forgeri':40B,75C 'forgery.this':89C 'host':24B 'issu':90C 'know':70B 'let':7A 'lite':2A,20B,28B,84C 'log':48B 'logged-in':47B 'make':60B 'malici':54B 'n/a':94C 'newslett':1A,19B,27B,81C,83C,92C 'newsletters-lit':18B,82C 'packag':21B 'page':55B 'plugin':4A,30B,64B 'request':39B,74C,88C 'self':23B 'self-host':22B 'set':66B 'site':38B,73C,87C 'softwar':33B,80C 'tribul':32B,79C 'trick':58B 'version':43B 'visit':52B 'vulner':77C 'without':69B 'wordpress':3A,25B,29B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Newsletters Lite plugin at version 4.18.2 or earlier are exposed. Risk is highest where administrators stay logged in while browsing other sites. Sites without the plugin installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116863","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116863","severity":null,"published_at":"2026-10-27T16:17:30+00:00","modified_at":"2026-10-27T16:17:30+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}