{"id":"CVE-2026-119512","kind":"vulnerability","aliases":["CVE-2026-119512"],"related":[],"title":"Newsletters Lite WordPress plugin: untrusted data deserialization allows object injection","description":"Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.2.","summary":"The Newsletters Lite WordPress plugin by Tribulant Software deserializes untrusted data, which allows PHP object injection. A successful attack can lead to code execution or data access on the site, depending on the classes available to the attacker.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["newsletters-lite","package","php","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Newsletters Lite plugin in the WordPress admin under Plugins; affected versions are through `4.18.2`.","fix":"- Newsletters Lite: unknown fixed version in the sources; move past `4.18.2` once the vendor names one.","status":"open","published_at":"2026-11-13T15:17:32+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","triaged_at":"2026-11-13T15:48:11+00:00","updated_at":"2026-11-13T15:48:11+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:48:11Z","model":"claude-haiku-5-5","output":{"fix":"- Newsletters Lite: unknown fixed version in the sources; move past `4.18.2` once the vendor names one.","reach":"internet","title":"Newsletters Lite WordPress plugin: untrusted data deserialization allows object injection","impact":"high","summary":"The Newsletters Lite WordPress plugin by Tribulant Software deserializes untrusted data, which allows PHP object injection. A successful attack can lead to code execution or data access on the site, depending on the classes available to the attacker.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","newsletters-lite","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code or reads data on the WordPress server","analyst_note":"Confirm the fixed version and attack preconditions for Newsletters Lite past 4.18.2 from the NVD entry and the vendor or WordPress plugin page.","how_to_check":"- Check the installed version of the Newsletters Lite plugin in the WordPress admin under Plugins; affected versions are through `4.18.2`.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Newsletters Lite WordPress plugin version 4.18.2 or earlier are exposed. The sources do not say which configurations or roles are needed to reach the vulnerable code, so unknown whether the attack needs logged-in access.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000742,"input_tokens":4527,"output_tokens":578,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119512':13A,16A '-2026':12A,15A '4.18.2':82C 'access':49B 'affect':77C 'allow':8A,35B,73C 'attack':41B,60B 'avail':57B 'class':56B 'code':45B 'cve':11A,14A 'data':6A,33B,48B,64C 'depend':53B 'deseri':7A,31B,61C 'execut':46B 'inject':10A,38B 'injection.this':75C 'issu':76C 'lead':43B 'lite':2A,19B,25B,72C 'n/a':80C 'newslett':1A,18B,24B,69C,71C,78C 'newsletters-lit':17B,70C 'object':9A,37B,74C 'packag':20B 'php':21B,36B 'plugin':4A,27B 'site':52B 'softwar':30B,68C 'success':40B 'tribul':29B,67C 'untrust':5A,32B,63C 'vulner':65C 'wordpress':3A,22B,26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Newsletters Lite WordPress plugin version 4.18.2 or earlier are exposed. The sources do not say which configurations or roles are needed to reach the vulnerable code, so unknown whether the attack needs logged-in access.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","newsletterslite","package","php","wordpress"],"campaign_type":null,"search_a":"'-119512':13A,16A '-2026':12A,15A 'allow':8A 'cve':11A,14A 'data':6A 'deseri':7A 'inject':10A 'lite':2A 'newslett':1A 'object':9A 'plugin':4A 'untrust':5A 'wordpress':3A","search_b":"'access':49B 'allow':35B 'attack':41B,60B 'avail':57B 'class':56B 'code':45B 'data':33B,48B 'depend':53B 'deseri':31B 'execut':46B 'inject':38B 'lead':43B 'lite':19B,25B 'newslett':18B,24B 'newsletters-lit':17B 'object':37B 'packag':20B 'php':21B,36B 'plugin':27B 'site':52B 'softwar':30B 'success':40B 'tribul':29B 'untrust':32B 'wordpress':22B,26B","search_c":"'4.18.2':82C 'affect':77C 'allow':73C 'data':64C 'deseri':61C 'injection.this':75C 'issu':76C 'lite':72C 'n/a':80C 'newslett':69C,71C,78C 'newsletters-lit':70C 'object':74C 'softwar':68C 'tribul':67C 'untrust':63C 'vulner':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119512","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119512","severity":null,"published_at":"2026-11-13T15:17:32+00:00","modified_at":"2026-11-13T15:17:32+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","fetched_at":"2026-11-13T15:46:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}