Tribulant Newsletters CVE-2026-116863

Exploitation requires a logged-in, privileged WordPress user (the plugin's administrative functions) of a site running Tribulant Newsletters (newsletters-lite) version through 4.18.2 to be tricked into interacting with attacker-controlled content while their session is active - this user interaction (UI:R) and the dependence on a privileged victim being authenticated are the primary limiting factors. The attacker themselves needs no account (PR:N). The exploit succeeds because the affected request lacks adequate anti-CSRF nonce validation; the exact endpoint and forced action are not described in the available sources. No fixed version is stated in the supplied evidence.

Signals are mixed and must not be read as uniformly critical. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) is Patchstack's scoring and reflects an unauthenticated network trigger with scope change and full CIA impact - but it depends entirely on a victim with privileges performing user interaction (UI:R), which CSRF always requires. The vuln.today decision label is 'act_now', signaling the triage pipeline treats this as priority. However, no EPSS probability, no CISA KEV listing, and no confirmed public exploit were provided, so there is no evidence of actual in-the-wild exploitation or mass scanning. The high C:H/I:H/A:H and S:C values are not substantiated by the description, which merely states a CSRF exists without naming the forged action - the real-world impact therefore cannot be confirmed from the evidence and the 9.6 should be treated as an upper-bound severity, not a demonstrated outcome. Net: this is a genuine priority to patch for sites running the affected plugin, but the 'critical' framing rests on an undescribed trigger and should be verified against the Patchstack advisory before assuming full admin-level compromise.

An attacker crafts a malicious web page or link and lures a logged-in WordPress administrator (or privileged user) of a site running Newsletters ≤4.18.2 into visiting it; the page silently issues a forged request to the plugin that the victim's authenticated browser session executes without consent. The specific action forced by the request is not described in the available sources, so the concrete outcome cannot be confirmed. No public exploit code was identified at time of analysis.