Newsletters (WordPress) CVE-2026-12583

Exploitation requires that the target run the Newsletters plugin at a version before 4.15 and that the plugin's public-facing form (the subscriber/subscription input handler) be reachable and accepting submissions - this is the default deployment state for a plugin whose purpose is public newsletter sign-up. No authentication is needed (PR:N) and no user interaction is required (UI:N). The main limiting factor is attack complexity (AC:H): a reliable payload must match the plugin's bundled POP gadget chain, and success depends on the specific vulnerable version being installed and PHP being able to write to a target path; the public POC substantially reduces this barrier. No non-standard configuration is otherwise required.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1, High) reflects a network-reachable, unauthenticated (PR:N) flaw with no user interaction but high attack complexity (AC:H) and full CIA impact - consistent with a deserialization RCE where crafting/aligning the object payload against a specific plugin version is non-trivial. Publicly available exploit code raises the practical risk materially, since the AC:H barrier is largely eliminated once a working payload is published. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified, and no SSVC decision data or KEV listing is present - meaning there is no confirmation of active exploitation, only proven exploitability. On balance this is a genuine high priority for any environment running the plugin: unauthenticated RCE with a bundled gadget chain and a public POC is a strong candidate for opportunistic mass-scanning, even though widespread active exploitation is not yet evidenced.

An attacker locates a WordPress site running Newsletters below 4.15, then submits a crafted serialized PHP object through the plugin's public subscription form with no account or authentication required. When the server deserializes the input, the plugin's bundled gadget chain fires, writing a PHP webshell into the webroot and yielding remote code execution; a public POC for this exact flow is available via WPScan, lowering the practical difficulty despite the CVSS AC:H rating.