Tribulant Newsletters CVE-2026-94075

Requires the Tribulant Newsletters (newsletters-lite) plugin installed and active at version ≤ 4.18.1 on a WordPress site. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with no user interaction, but the specific vulnerable feature, parameter, or endpoint that reaches the unserialize() call is not described in the available sources. The practical impact of this PHP Object Injection depends on a usable POP gadget chain being reachable in the plugin, WordPress core, or another installed component; without such a chain the real-world impact is limited, and this limiting factor is not resolved by the provided data.

Signals point toward high priority but rest on a single source. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) describes a network-reachable, low-complexity flaw needing no privileges or user interaction, and vuln.today assigns an 'act_now' decision label. However, the only reference is a Patchstack vulnerability-database advisory - there is no EPSS score, no CISA KEV listing, and no confirmed proof-of-concept or exploit code in the provided data, so exploitation is at present theoretical rather than demonstrated. A key caveat: CWE-502 PHP Object Injection yields its claimed C:H/I:H/A:H impact only when a usable POP gadget chain is reachable (often from the plugin itself, WordPress core, or other installed code); the available sources do not state the trigger or confirm a gadget chain, so the maximal impact is an upper bound, not a verified outcome. Treat this as a genuine high-priority patching target for sites running the plugin, while recognizing the severity rests on Patchstack's CVSS rating alone and the exploitation mechanics are unverified.

A remote attacker sends a crafted request to a WordPress site running the Newsletters plugin (≤ 4.18.1) that carries attacker-controlled serialized PHP data into a vulnerable unserialize() call. If a suitable POP gadget chain is present in the plugin, WordPress, or another installed component, the injected object can be instantiated to escalate into code execution, data access, or site compromise. No public exploit code is identified in the available data, and the exact entry point is not described in the sources.