CVE-2026-16267

The Newsletters WordPress plugin, prior to version 4.16, does not restrict the classes allowed during unserialisation of a value submitted via a public form. This allows unauthenticated attackers to inject arbitrary PHP objects. Affected: Newsletters plugin