CVE-2026-116863

Summary

Cross-Site Request Forgery (CSRF) in Tribulant Software Newsletters plugin allows attackers to trick authenticated users into performing unintended actions, such as subscribing or unsubscribing users, without their knowledge or consent.

Exploitability

Exploitation requires social engineering to诱导 a logged-in admin or user to click a malicious link or visit a crafted page; no authentication bypass or complex conditions are needed beyond user interaction.

Blast radius

An attacker could manipulate newsletter subscriptions on behalf of authenticated users, potentially leading to unauthorized data changes, spam abuse, or loss of user trust.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Newsletters version 4.18.3 or later, which includes a fix for this CSRF vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.