{"id":"CVE-2026-119616","kind":"vulnerability","aliases":["CVE-2026-119616"],"related":[],"title":"Noptin WordPress plugin: unauthenticated file inclusion can run PHP code","description":"The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptin_fields[first_name]' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The public Manage Preferences page issues a nonce to unauthenticated visitors, meaning there is no effective authorization barrier — an unauthenticated attacker can store the malicious payload as their first_name and have it executed the next time any newsletter is sent by the site operator. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.","summary":"The Noptin newsletter plugin for WordPress lets unauthenticated visitors store a crafted value in the first_name field, and a Local File Inclusion flaw then includes arbitrary .php files on the server when a newsletter is sent. An attacker can run PHP code, bypass access controls, or read sensitive data once an administrator takes the triggering action.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["noptin","other","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","plugin-updated-past-4.4.3"],"how_to_check":"- Check the installed Noptin version in the WordPress admin under Plugins; the sources say all versions up to and including `4.4.3` are affected.\n- Confirm whether the Noptin plugin is active on the site, since only installed plugins are exposed.","fix":"- Noptin: a patch is linked in the sources, but the fixed version is not stated; check the plugin's update channel for a release newer than `4.4.3`.","status":"open","published_at":"2026-11-07T03:17:02+00:00","first_seen_at":"2026-11-07T03:45:33+00:00","triaged_at":"2026-11-07T03:48:02+00:00","updated_at":"2026-11-07T03:48:02+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-07T03:48:02Z","model":"claude-haiku-5-5","output":{"fix":"- Noptin: a patch is linked in the sources, but the fixed version is not stated; check the plugin's update channel for a release newer than `4.4.3`.","reach":"internet","title":"Noptin WordPress plugin: unauthenticated file inclusion can run PHP code","impact":"high","summary":"The Noptin newsletter plugin for WordPress lets unauthenticated visitors store a crafted value in the first_name field, and a Local File Inclusion flaw then includes arbitrary .php files on the server when a newsletter is sent. An attacker can run PHP code, bypass access controls, or read sensitive data once an administrator takes the triggering action.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","noptin","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs arbitrary PHP code on the web server.","analyst_note":"","how_to_check":"- Check the installed Noptin version in the WordPress admin under Plugins; the sources say all versions up to and including `4.4.3` are affected.\n- Confirm whether the Noptin plugin is active on the site, since only installed plugins are exposed.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-updated-past-4.4.3"],"who_is_affected":"Sites running the Noptin plugin for WordPress at version `4.4.3` or earlier are exposed. The flaw is reached through the public Manage Preferences page and the first_name field, and it fires when the site sends a newsletter, so sites that do not run Noptin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001165,"input_tokens":4451,"output_tokens":1439,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119616':13A,16A '-2026':12A,15A '4.4.3':104C 'access':67B,146C 'achiev':152C 'action':79B,216C 'addit':213C 'administr':75B,219C 'allow':130C 'arbitrari':49B,124C 'attack':61B,119C,186C,221C 'author':182C 'autom':87C 'barrier':183C 'bypass':66B,145C 'cannot':222C 'case':156C 'code':10A,65B,136C,153C 'control':68B,147C 'craft':34B 'cve':11A,14A 'data':72B,150C 'effect':181C 'email':86C 'execut':123C,132C,154C,199C 'exploit':212C 'field':40B,108C 'file':5A,44B,51B,95C,126C,139C,159C 'first':38B,109C,194C 'flaw':46B 'host':21B 'includ':48B,103C,121C,165C 'inclus':6A,45B,96C 'issu':171C 'let':29B 'local':43B,94C 'make':114C 'malici':190C 'manag':168C 'mean':177C 'name':39B,110C,195C 'new':83C 'newslett':25B,57B,82C,204C 'next':201C 'nonc':173C 'noptin':1A,17B,24B,81C,107C 'notif':85C 'obtain':148C 'oper':210C 'page':170C 'paramet':111C,112C 'payload':191C 'php':9A,50B,64B,125C,135C,158C 'plugin':3A,26B,88C 'possibl':116C 'post':84C 'prefer':169C 'public':167C 'read':70B 'requir':214C 'run':8A,63B 'self':20B 'self-host':19B 'sensit':71B,149C 'sent':59B,206C 'server':54B,129C 'site':209C 'store':32B,188C 'success':211C 'take':76B 'time':202C 'trigger':78B,223C 'type':160C 'unauthent':4A,30B,118C,175C,185C 'upload':163C 'use':143C 'valu':35B 'version':99C 'via':105C 'visitor':31B,176C 'vulner':92C,225C 'wordpress':2A,22B,28B,90C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Noptin plugin for WordPress at version `4.4.3` or earlier are exposed. The flaw is reached through the public Manage Preferences page and the first_name field, and it fires when the site sends a newsletter, so sites that do not run Noptin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","noptin","other","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119616':13A,16A '-2026':12A,15A 'code':10A 'cve':11A,14A 'file':5A 'inclus':6A 'noptin':1A 'php':9A 'plugin':3A 'run':8A 'unauthent':4A 'wordpress':2A","search_b":"'access':67B 'action':79B 'administr':75B 'arbitrari':49B 'attack':61B 'bypass':66B 'code':65B 'control':68B 'craft':34B 'data':72B 'field':40B 'file':44B,51B 'first':38B 'flaw':46B 'host':21B 'includ':48B 'inclus':45B 'let':29B 'local':43B 'name':39B 'newslett':25B,57B 'noptin':17B,24B 'php':50B,64B 'plugin':26B 'read':70B 'run':63B 'self':20B 'self-host':19B 'sensit':71B 'sent':59B 'server':54B 'store':32B 'take':76B 'trigger':78B 'unauthent':30B 'valu':35B 'visitor':31B 'wordpress':22B,28B","search_c":"'4.4.3':104C 'access':146C 'achiev':152C 'action':216C 'addit':213C 'administr':219C 'allow':130C 'arbitrari':124C 'attack':119C,186C,221C 'author':182C 'autom':87C 'barrier':183C 'bypass':145C 'cannot':222C 'case':156C 'code':136C,153C 'control':147C 'data':150C 'effect':181C 'email':86C 'execut':123C,132C,154C,199C 'exploit':212C 'field':108C 'file':95C,126C,139C,159C 'first':109C,194C 'includ':103C,121C,165C 'inclus':96C 'issu':171C 'local':94C 'make':114C 'malici':190C 'manag':168C 'mean':177C 'name':110C,195C 'new':83C 'newslett':82C,204C 'next':201C 'nonc':173C 'noptin':81C,107C 'notif':85C 'obtain':148C 'oper':210C 'page':170C 'paramet':111C,112C 'payload':191C 'php':125C,135C,158C 'plugin':88C 'possibl':116C 'post':84C 'prefer':169C 'public':167C 'requir':214C 'sensit':149C 'sent':206C 'server':129C 'site':209C 'store':188C 'success':211C 'time':202C 'trigger':223C 'type':160C 'unauthent':118C,175C,185C 'upload':163C 'use':143C 'version':99C 'via':105C 'visitor':176C 'vulner':92C,225C 'wordpress':90C","first_public_at":"2026-11-07T03:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119616","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119616","severity":null,"published_at":"2026-11-07T03:17:02+00:00","modified_at":"2026-11-07T03:17:02+00:00","first_seen_at":"2026-11-07T03:45:33+00:00","fetched_at":"2026-11-07T03:45:33+00:00","note":null}],"documents":[{"id":92405,"url":"https://github.com/hizzle-co/noptin/commit/f5ea148ad1b7744d27b20244795d63092267f497","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}