CVE-2026-16268 PoC — Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-16268.yaml

Associated Vulnerability

Title: Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler (CVE-2026-16268)
Description:The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.

Description

Newsletters WordPress plugin < 4.16 contains a server-side request forgery caused by lack of authentication and validation in bounce-processing requests, letting unauthenticated attackers make arbitrary requests to internal or external hosts.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →