Live › vulnerability › CVE-2026-94075
Go to dashboardThe Newsletters Lite plugin by Tribulant Software for WordPress deserializes untrusted data, which allows object injection. Sources do not say what an attacker gets beyond that; object injection in PHP often leads to code execution, but that is not confirmed here.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 08:47 UTC. All times on this page are UTC.
Sites running the Newsletters Lite WordPress plugin at version 4.18.1 or earlier are affected. Sites that do not have this plugin installed can skip it. The sources do not describe any configuration that limits exposure.
No product ranges from the sources yet.
wp plugin get newsletters-lite --field=version4.18.14.18.1; the fixed version number is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-94075")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.