CVE-2026-94075

CVE-2026-94075 · WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.

CVSS 9.8 · Critical · EPSS 0.4% · Fix available

Published: 2026-10-24T08:00:11.463Z
Updated: 2026-10-24T14:46:59.162Z

Affected products and versions

newsletters
Versions
- ≥ 0, ≤ 4.18.1: Affected; ≥ 4.18.2: Not affected (custom)
Update to 4.18.2

Original sources

https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-1-php-object-injection-vulnerability?_s_id=cve
https://nvd.nist.gov/vuln/detail/CVE-2026-94075

Check your server →