Zero Radar
← feed
CriticalVulnerabilityCVE-2026-116863updated 27 Oct 2026, 19:35 UTC

Newsletters Lite WordPress plugin: forged requests can change settings

Attackers can trick a logged-in site administrator into clicking a hidden link or visiting a booby-trapped page, which then makes changes on the website without the admin knowing. The attacker could potentially take control of the newslette

Official, 2 sources
SeverityCriticalCVSS 9.6 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker builds pageHidden request aimed at the plugin
  2. 2Admin visits pageAdmin is logged in to WordPress
  3. 3Browser sends requestLogin cookies are sent automatically
  4. 4Plugin accepts requestNo anti-forgery check on the action
  5. 5Settings changedAction runs without admin consent
  6. ResultPlugin actions run as the admin

What happened

A Cross-Site Request Forgery (CSRF) flaw in the Newsletters Lite plugin by Tribulant Software lets a malicious third-party site trigger authenticated actions in the plugin when a logged-in user visits it. The material does not specify the exact actions reachable.

Why it is dangerous: Because the plugin does not verify that requests come from its own admin pages, an attacker can make a logged-in administrator perform actions they did not intend. Sites where administrators are logged in while browsing the web are most at risk.

Are you affected?

You are affected if you run the Newsletters Lite (newsletters-lite) WordPress plugin version 4.18.2 or earlier.

Newsletters (newsletters-lite) WordPress plugin: all versions through 4.18.2

What to do

  1. Check whether the Newsletters Lite plugin is installed and what version it is; if it is 4.18.2 or earlier, treat it as vulnerable.
  2. Update the plugin to a newer version as soon as the vendor releases one that fixes this issue, and check the plugin's changelog or the advisory for the fixed version.
  3. Until a fix is installed, avoid browsing other websites while logged in to your WordPress admin dashboard, or log out after each admin session.
  4. If the plugin is not needed, deactivate and remove it.

Timeline

  1. 27 Oct 2026, 16:17 UTC
    Publicly disclosed
  2. 27 Oct 2026, 16:17 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 16:20 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 19:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116863 · GHSA-r394-jh8x-rp4v
CVSS
9.6 / 10
EPSS
0.2% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 16:17 UTC
On Zero Radar
27 Oct 2026, 16:20 UTC (3 min after disclosure)
Last change
27 Oct 2026, 19:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Newsletters Lite WordPress plugin: forged requests can change settings · Zero Radar