Zero Radar
← feed
CriticalVulnerabilityCVE-2026-94075updated 25 Oct 2026, 17:20 UTC

Newsletters Lite WordPress plugin can be abused to run attacker code

A flaw in this WordPress newsletter plugin lets an attacker send specially crafted data that the site then trusts and processes. This can let the attacker take control of the website.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSends crafted malicious data to the site
  2. 2Vulnerable pluginPlugin unsafely converts data into objects
  3. 3ServerAttacker-chosen code may run on the server
  4. 4Site dataData or the site itself can be taken over
  5. ResultAttacker gains control of the website

What happened

Newsletters (newsletters-lite) by Tribulant Software has an unsafe deserialization flaw, classed as PHP object injection, that allows untrusted data to be turned into objects on the server.

Why it is dangerous: A successful attacker could potentially run code on the server, steal data, or deface or take over the website. Any site running the affected plugin is at risk.

Are you affected?

You are affected if you run the Newsletters (newsletters-lite) WordPress plugin version 4.18.1 or earlier.

Newsletters (newsletters-lite) WordPress plugin: all versions through 4.18.1

What to do

  1. Check whether the Newsletters (newsletters-lite) plugin is installed and what version it is
  2. Update to a version later than 4.18.1 as soon as a fixed release is available from the vendor
  3. Until then, consider disabling the plugin or restricting access to the site's admin and plugin endpoints
  4. Review the site for signs of unexpected changes or unknown admin accounts

Timeline

  1. 24 Oct 2026, 08:16 UTC
    Publicly disclosed
  2. 24 Oct 2026, 08:16 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-94075 · GHSA-rfh9-4r53-w9wc
CVSS
9.8 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
24 Oct 2026, 08:16 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Newsletters Lite WordPress plugin can be abused to run attacker code · Zero Radar