Newsletters Plugin CVE-2026-16268

Exploitation requires that the target WordPress site has the Newsletters plugin installed and active at a version below 4.16. No authentication is required - the vulnerable bounce-processing endpoint accepts unauthenticated HTTP requests by design (it was meant to receive bounce notifications from external mail servers). No special configuration beyond plugin activation is needed. The practical impact of SSRF is significantly amplified when the WordPress server has access to sensitive internal resources: cloud metadata endpoints (169.254.169.254), internal admin interfaces, or unauthenticated internal APIs. Exploitation is limited by the fact that the attacker receives responses only indirectly (or not at all, depending on implementation), making it a semi-blind SSRF in many configurations - SSVC rates it non-automatable, suggesting manual exploitation targeting is required to extract useful data.

The NVD CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) scores this at 8.2, with I:H being an aggressive rating for a basic SSRF - integrity impact of this magnitude typically implies the SSRF can trigger meaningful write operations against internal services, which is plausible if internal APIs lack authentication. However, EPSS at 0.14% (3rd percentile) suggests extremely low observed exploitation activity, directly contradicting the high CVSS urgency signal. SSVC confirms non-automatable exploitation and only partial technical impact, aligning with EPSS rather than CVSS. A public POC exists (WPScan), raising the probability of targeted exploitation against specific high-value WordPress deployments, but mass automated scanning appears unlikely. This vulnerability is a real priority for organizations running this plugin in environments with sensitive internal services reachable from the web server (cloud hosting with metadata services, self-hosted with internal APIs), but lower urgency for isolated shared-hosting environments. The gap between CVSS and EPSS/SSVC signals should be noted: treat this as a medium-urgency patch, not an emergency.

An unauthenticated attacker sends a crafted HTTP POST to the Newsletters plugin bounce-processing endpoint, supplying a URL pointing to the AWS EC2 instance metadata service (http://169.254.169.254/latest/meta-data/iam/security-credentials/). The WordPress server fetches the URL and returns the response, disclosing temporary IAM credentials that the attacker uses to pivot into the AWS environment. A public POC is available via WPScan, lowering the technical bar for this attack.