CVE-2026-16268

The CVE concerns the Newsletters WordPress plugin (pre-4.16) that fails to authenticate/validate a bounce-processing request before fetching a user-supplied URL on the server side, enabling unauthenticated SSRF to arbitrary internal/external hosts. Affected component: WordPress plugin function ha...