{"id":"CVE-2026-94075","kind":"vulnerability","aliases":["CVE-2026-94075"],"related":[],"title":"Newsletters Lite WordPress plugin: untrusted data object injection, up to 4.18.1","description":"Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.","summary":"The Newsletters Lite plugin by Tribulant Software for WordPress deserializes untrusted data, which allows object injection. Sources do not say what an attacker gets beyond that; object injection in PHP often leads to code execution, but that is not confirmed here.","severity":"critical","cvss":9.8,"epss":0.00564,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["newsletters-lite","package","php","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version of Newsletters Lite (newsletters-lite) in the WordPress admin under Plugins, or with `wp plugin get newsletters-lite --field=version`\n- Compare the result against the affected range, which runs up to and including `4.18.1`","fix":"- Update the Newsletters Lite plugin (newsletters-lite) to a version later than `4.18.1`; the fixed version number is unknown from the sources\n- If no fixed version is available, deactivate and remove the plugin until one is","status":"open","published_at":"2026-10-24T08:16:52+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","triaged_at":"2026-10-25T02:59:40+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T02:59:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Newsletters Lite plugin (newsletters-lite) to a version later than `4.18.1`; the fixed version number is unknown from the sources\n- If no fixed version is available, deactivate and remove the plugin until one is","reach":"internet","title":"Newsletters Lite WordPress plugin: untrusted data object injection, up to 4.18.1","impact":"high","summary":"The Newsletters Lite plugin by Tribulant Software for WordPress deserializes untrusted data, which allows object injection. Sources do not say what an attacker gets beyond that; object injection in PHP often leads to code execution, but that is not confirmed here.","category":"package","nicknames":[],"who_cares":["wordpress","php","newsletters-lite"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; attacker may run code on the server","analyst_note":"Confirm the fixed version and the exact vulnerable entry point at https://nvd.nist.gov/vuln/detail/CVE-2026-94075 and the plugin's changelog.","how_to_check":"- Check the installed plugin version of Newsletters Lite (newsletters-lite) in the WordPress admin under Plugins, or with `wp plugin get newsletters-lite --field=version`\n- Compare the result against the affected range, which runs up to and including `4.18.1`","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Newsletters Lite WordPress plugin at version 4.18.1 or earlier are affected. Sites that do not have this plugin installed can skip it. The sources do not describe any configuration that limits exposure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000638,"input_tokens":3292,"output_tokens":618,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-94075':14A,17A '4.18.1':11A,85C 'affect':80C 'allow':37B,76C 'attack':46B 'beyond':48B 'code':57B 'confirm':63B 'cve':12A,15A 'data':6A,35B,67C 'deseri':33B,64C 'execut':58B 'get':47B 'inject':8A,39B,51B 'injection.this':78C 'issu':79C 'lead':55B 'lite':2A,20B,26B,75C 'n/a':83C 'newslett':1A,19B,25B,72C,74C,81C 'newsletters-lit':18B,73C 'object':7A,38B,50B,77C 'often':54B 'packag':21B 'php':22B,53B 'plugin':4A,27B 'say':43B 'softwar':30B,71C 'sourc':40B 'tribul':29B,70C 'untrust':5A,34B,66C 'vulner':68C 'wordpress':3A,23B,32B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Newsletters Lite WordPress plugin at version 4.18.1 or earlier are affected. Sites that do not have this plugin installed can skip it. The sources do not describe any configuration that limits exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T08:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94075","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94075","severity":null,"published_at":"2026-10-24T08:16:52+00:00","modified_at":"2026-10-24T08:16:52+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","fetched_at":"2026-10-24T08:47:15+00:00","note":null},{"source":"epss","external_id":"CVE-2026-94075","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-94075","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}