What is the CVSS score of CVE-2026-16268?

CVE-2026-16268 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Newsletters Plugin are affected by CVE-2026-16268?

The Newsletters WordPress plugin (versions before 4.16) contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allowing attackers to force affected servers to issue HTTP…. A patch is available.

Is there a public PoC exploit available for CVE-2026-16268?

Yes, a public proof-of-concept exploit is available for CVE-2026-16268. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-16268?

Within 24 hours, inventory all WordPress installations using Newsletters plugin and confirm versions in production. Within 7 days, deploy Newsletters plugin version 4.16 or later across staging environments for compatibility validation, then execute production rollout with immediate post-deployment verification. Within 30 days, audit web server logs for suspicious activity targeting the bounce-processing endpoint and confirm remediation completeness across all instances.

Newsletters Plugin CVE-2026-16268

EUVD-2026-53723 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-06 WPScan

GHSA-mhrm-79mh-vhfj

WordPress SSRF Newsletters

8.2

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

6.5 MEDIUM

SSRF yields limited confidentiality (internal service probing) and limited integrity (interaction with internal services); I:H overstates impact absent confirmed write exploitation.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:24 vuln.today

Patch available

Aug 06, 2026 - 07:02 EUVD

CVE Published

Aug 06, 2026 - 06:00 cve.org

HIGH 8.2

CVE Published

Aug 06, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.

AnalysisAI

Server-Side Request Forgery (SSRF) in the Newsletters WordPress plugin before 4.16 allows unauthenticated remote attackers to force the hosting server to issue HTTP requests to arbitrary internal or external URLs via the unauthenticated bounce-processing endpoint. A publicly available proof-of-concept exists per WPScan reporting. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site with Newsletters plugin

Delivery

Send unauthenticated request to bounce-processing endpoint with attacker-controlled URL

Exploit

Server performs server-side fetch of arbitrary URL

Execution

Attacker probes internal network or cloud metadata

Impact

Harvest internal credentials or enumerate internal services

Access

Identify WordPress site with Newsletters plugin

Delivery

Send unauthenticated request to bounce-processing endpoint with attacker-controlled URL

Exploit

Server performs server-side fetch of arbitrary URL

Execution

Attacker probes internal network or cloud metadata

Impact

Harvest internal credentials or enumerate internal services

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target WordPress site has the Newsletters plugin installed and active at a version below 4.16. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) scores this at 8.2, with I:H being an aggressive rating for a basic SSRF - integrity impact of this magnitude typically implies the SSRF can trigger meaningful write operations against internal services, which is plausible if internal APIs lack authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker sends a crafted HTTP POST to the Newsletters plugin bounce-processing endpoint, supplying a URL pointing to the AWS EC2 instance metadata service (http://169.254.169.254/latest/meta-data/iam/security-credentials/). The WordPress server fetches the URL and returns the response, disclosing temporary IAM credentials that the attacker uses to pivot into the AWS environment. …
Remediation	Update the Newsletters WordPress plugin to version 4.16 or later, which contains the vendor-released patch addressing the missing authentication and URL validation on the bounce-processing endpoint. … Detailed patch versions, workarounds, and compensating controls in full report.