{"id":"CVE-2026-94075","published":"2026-10-24T08:16:52.790","lastModified":"2026-10-26T13:41:11.497","description":"Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-1-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Newsletters plugin for WordPress versions through 4.18.1 contains a deserialization vulnerability (CWE-502) that allows attackers to inject malicious PHP objects via untrusted data, potentially leading to remote code execution or other serious impacts.","exploitability":"Exploitation is straightforward for remote attackers since it requires no authentication, user interaction, or special conditions; the flaw exists in a publicly accessible deserialization path.","blast_radius":"Successful exploitation could allow full compromise of the affected WordPress site—including data theft, site defacement, or use as a pivot point for further attacks—due to the CVSS 9.8 severity and lack of authentication requirements.","remediation":"Upgrade to Newsletters plugin version 4.18.2 or later, which contains the vendor's fix for the object injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["deserialization","object-injection","php","webapp"],"model":"garnet-coder","analyzedAt":"2026-10-24T09:03:28.110Z"}}