What is the CVSS score of CVE-2026-12583?

CVE-2026-12583 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Newsletters (WordPress) are affected by CVE-2026-12583?

The Newsletters WordPress plugin prior to version 4.15 contains a critical remote code execution vulnerability allowing unauthenticated attackers to inject and execute arbitrary code through…. A patch is available.

Is there a public PoC exploit available for CVE-2026-12583?

Yes, a public proof-of-concept exploit is available for CVE-2026-12583. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-12583?

Within 24 hours: Identify all WordPress installations using Newsletters plugin versions prior to 4.15 and assess whether the plugin is actively deployed with public form access enabled. Within 7 days: Update the Newsletters plugin to version 4.15 or later on all affected systems and verify successful deployment; conduct file integrity checks on plugin directories for evidence of prior exploitation. Within 30 days: Perform comprehensive log analysis covering the past 30 days for suspicious activity targeting the plugin endpoint, implement Web Application Firewall rules to restrict access to the vulnerable form submission path, and disable the plugin entirely if not actively required for business operations.

Newsletters (WordPress) CVE-2026-12583

EUVD-2026-43627 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-14 WPScan

GHSA-cxqr-jhpf-63mm

PHP WordPress Deserialization Newsletters Unknown

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable, unauthenticated public form (AV:N/PR:N/UI:N); AC:H because a version-specific POP payload must be crafted; deserialization RCE yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 13:23 vuln.today

CVSS changed

Jul 14, 2026 - 13:22 NVD

8.1 (HIGH)

Patch available

Jul 14, 2026 - 11:17 EUVD

CVE Published

Jul 14, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 14, 2026 - 06:00 cve.org

HIGH 8.1

DescriptionCVE.org

The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.

AnalysisAI

Unauthenticated PHP object injection in the Newsletters WordPress plugin before 4.15 lets remote attackers deserialize attacker-controlled data submitted through a public-facing form, then leverage a property-oriented gadget chain bundled inside the plugin itself to write arbitrary files and achieve remote code execution on the host. Publicly available exploit code exists (published via WPScan), though there is no public exploit identified as being used in active attacks and the flaw is not listed in CISA KEV. The self-contained gadget chain removes the usual dependency on third-party gadgets, making reliable exploitation notably more achievable than typical POI bugs.

Technical ContextAI

The affected component is the Newsletters plugin for WordPress (CPE cpe:2.3:a:unknown:newsletters), a subscriber/email-campaign management extension. The root cause is CWE-502 (Deserialization of Untrusted Data): user input captured by a public form is passed to PHP's unserialize() without validation or an allow-list, so an attacker can supply a serialized PHP object of a class of their choosing. Exploitation is elevated from mere object instantiation to full RCE because the plugin ships a POP (property-oriented programming) gadget chain - magic methods such as __wake up/__destruct across the plugin's own classes that, when triggered during deserialization, chain into filesystem-write primitives and ultimately code execution. Because the gadgets are bundled with the plugin, the attack does not depend on the presence of vulnerable gadgets in WordPress core or other plugins.

RemediationAI

Vendor-released patch: version 4.15 - upgrade the Newsletters plugin to 4.15 or later immediately, as the fix eliminates the unsafe deserialization of public form input. Consult the WPScan advisory at https://wpscan.com/vulnerability/e4c44105-f43d-4dff-8487-7d8ae2691c4e/ for details. If patching cannot be done at once, apply compensating controls: deactivate the Newsletters plugin entirely (removes the vulnerable code path but disables all newsletter/subscription functionality), or place a WAF rule in front of the site to block requests to the plugin's public form endpoints containing serialized PHP payloads (patterns such as leading 'O:' or 'a:' object/array markers) - noting WAF signatures can be bypassed with obfuscated payloads and may produce false positives on legitimate submissions. Additionally restrict web-server write permissions on the WordPress directory to blunt the arbitrary-file-write primitive, accepting that this can break other plugins that legitimately write files.