CVE-2026-12583

The Newsletters WordPress plugin (versions before 4.15) is affected by an insecure deserialization vulnerability. Specifically, untrusted input stored via a public form can be deserialized, allowing an unauthenticated attacker to inject a PHP object and, using a property‑oriented gadget chain bun...