What is the CVSS score of EUVD-2026-54729?

EUVD-2026-54729 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Newsletters Plugin are affected by EUVD-2026-54729?

The Newsletters WordPress plugin (versions before 4.16) contains a critical flaw allowing unauthenticated attackers to inject malicious code, potentially leading to site compromise, data theft, or…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-54729?

Yes, a public proof-of-concept exploit is available for EUVD-2026-54729. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-54729?

Within 24 hours: Audit all WordPress installations to identify those running Newsletters plugin versions below 4.16; prioritize assessment of customer-facing and business-critical instances. Within 7 days: Upgrade the Newsletters plugin to version 4.16 or later across all affected WordPress installations and verify successful updates; if immediate patching is not possible, implement temporary Web Application Firewall rules to block form submissions containing serialized object payloads. Within 30 days: Verify patching completion across all environments; review co-installed plugins and libraries for related vulnerabilities; implement ongoing monitoring for exploitation attempts.

Newsletters Plugin EUVD-2026-54729

| CVE-2026-16267 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-08 WPScan

GHSA-jxc3-pfg8-hv86

PHP WordPress Deserialization Newsletters Unknown

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-accessible public form with no auth, but AC:H reflects mandatory gadget-chain prerequisite; full C/I/A impact if chain is present.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 20:56 vuln.today

CVSS changed

Aug 11, 2026 - 20:22 NVD

8.1 (HIGH)

Patch available

Aug 08, 2026 - 07:01 EUVD

CVE Published

Aug 08, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 08, 2026 - 06:00 cve.org

HIGH 8.1

DescriptionCVE.org

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.

AnalysisAI

PHP object injection in the Newsletters WordPress plugin (all versions before 4.16) permits unauthenticated remote attackers to supply arbitrary serialized PHP objects through a public-facing form, bypassing class restrictions entirely. If a suitable PHP gadget chain is present in the WordPress environment - commonly introduced by co-installed plugins or PHP libraries - this can escalate to remote code execution, data exfiltration, or full site compromise. A publicly available exploit has been confirmed by WPScan; however, EPSS stands at 0.16% (5th percentile), indicating limited observed mass exploitation at time of analysis despite the public PoC.

Technical ContextAI

CWE-502 (Deserialization of Untrusted Data) describes this root cause precisely: the plugin passes user-supplied input directly to PHP's unserialize() without restricting which classes may be instantiated. When PHP deserializes an object, it invokes magic methods such as __wakeup(), __destruct(), and __toString() on the resulting instance. Attackers craft a serialized payload that chains together class instances already loaded in the PHP process - commonly called a 'gadget chain' - so that these magic methods execute attacker-controlled logic upon deserialization. The attack surface is a public, unauthenticated form exposed by the Newsletters plugin, identified by CPE cpe:2.3:a:unknown:newsletters:*:*:*:*:*:*:*:*, covering all releases from 0 up to (but not including) 4.16. WordPress's plugin ecosystem is a prolific source of gadget-chain components, making this class of vulnerability particularly dangerous in multi-plugin deployments.

RemediationAI

Update the Newsletters WordPress plugin to version 4.16 or later, which introduces class restrictions on deserialization of form-submitted values. The patched release is confirmed by the EUVD affected version range (all releases below 4.16 are vulnerable). Details are available via the WPScan advisory at https://wpscan.com/vulnerability/b51c11d6-5bfa-4b2c-b348-cda19889deee/ and NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-16267. If immediate patching is not feasible, consider deploying a WAF rule to detect and block serialized PHP payloads (patterns beginning with O:, a:, s:, i:) in form submission bodies - note this may produce false positives if legitimate functionality passes serialized data. Alternatively, temporarily disabling the public-facing Newsletters subscription form eliminates the attack surface entirely until the patch is applied, though this disrupts subscriber acquisition workflows.