---
id: "CVE-2026-94075"
kind: "vulnerability"
aliases: ["CVE-2026-94075"]
title: "Newsletters Lite WordPress plugin: untrusted data object injection, up to 4.18.1"
severity: "critical"
cvss: 9.8
epss: 0.00564
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["newsletters-lite", "package", "php", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-24T08:16:52+00:00"
first_seen_at: "2026-10-24T08:47:15+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94075", "first_seen_at": "2026-10-24T08:47:15+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-94075", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Newsletters Lite WordPress plugin: untrusted data object injection, up to 4.18.1

The Newsletters Lite plugin by Tribulant Software for WordPress deserializes untrusted data, which allows object injection. Sources do not say what an attacker gets beyond that; object injection in PHP often leads to code execution, but that is not confirmed here.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version of Newsletters Lite (newsletters-lite) in the WordPress admin under Plugins, or with `wp plugin get newsletters-lite --field=version`
- Compare the result against the affected range, which runs up to and including `4.18.1`

## Fix

- Update the Newsletters Lite plugin (newsletters-lite) to a version later than `4.18.1`; the fixed version number is unknown from the sources
- If no fixed version is available, deactivate and remove the plugin until one is

## Timeline

- 2026-10-24T08:47:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-94075
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-94075

## From the sources

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_