CVE-2026-16268
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side. This allows unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.
Risk Assessment
An attacker can use the server to scan internal networks or attack external systems, potentially leading to security breaches and reputational damage.
Recommendation
Update the Newsletters plugin to the latest version that includes the fix. Additionally, restrict access to the bounce-processing functionality to authenticated users only.
Other vulnerabilities in Newsletters WordPress plugin
See all- CVE-2026-16264Medium
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request. This allows attackers to read any subscriber's personal data and overwrite any subscriber's record, including their email address.
- CVE-2026-12583High
The Newsletters WordPress plugin before version 4.15 fails to prevent deserialization of untrusted input submitted via a public form. This allows unauthenticated attackers to inject a PHP object and, through a property-oriented gadget chain, write arbitrary files and execute code on the server.
Original NVD description (English source)
The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS