Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-12583— Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field

Quick assessment

Affected
Unknown Newsletters
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress Newsletters是WordPress基金会的一款由 Tribulant Software 开发的 WordPress 邮件订阅与新闻通讯插件，提供邮件列表管理、模板构建、订阅表单、邮件追踪、自动回复等全功能，支持免费版和付费专业版。 WordPress Newsletters 4.15之前版本存在反序列化注入漏洞，该漏洞源于未防止反序列化通过公共表单存储的不可信输入，可能导致未经身份验证的攻击者注入PHP对象，并利用插件捆绑的属性导向小工具链写入任意文件并在服务器上执行代码。

AI Predicted 9.8 Difficulty: Easy EPSS 0.55% · P44

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown Newsletters < 4.15 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-12583

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field
Source: CVE Program / CVE List V5
Vulnerability Description
The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Newsletters 反序列化注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Newsletters是WordPress基金会的一款由 Tribulant Software 开发的 WordPress 邮件订阅与新闻通讯插件，提供邮件列表管理、模板构建、订阅表单、邮件追踪、自动回复等全功能，支持免费版和付费专业版。 WordPress Newsletters 4.15之前版本存在反序列化注入漏洞，该漏洞源于未防止反序列化通过公共表单存储的不可信输入，可能导致未经身份验证的攻击者注入PHP对象，并利用插件捆绑的属性导向小工具链写入任意文件并在服务器上执行代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Newsletters 0 ~ 4.15 -

II. Public POCs for CVE-2026-12583

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-12583

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-12583 (1)

Same Patch Batch · Unknown · 2026-07-14 · 6 CVEs total

CVE-2026-12988 WP 2FA < 3.1.1.2 - Account Takeover via 2FA Setup Email Binding
CVE-2026-11563 Word Count and Social Shares <= 1.0 - Subscriber+ Arbitrary File Deletion via Path Travers
CVE-2026-11567 SureForms < 2.11.1 - Unauthenticated Payment Amount Bypass
CVE-2026-12511 AI Engine < 3.5.5 - Editor+ Arbitrary File Write via Path Traversal
CVE-2025-15665 BEAF < 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field

IV. Related Vulnerabilities

Same product: Newsletters
Same vendor: Unknown

V. Comments for CVE-2026-12583

No comments yet

Leave a comment