CVE-2026-94075

Summary

The Newsletters plugin for WordPress versions through 4.18.1 contains a deserialization vulnerability (CWE-502) that allows attackers to inject malicious PHP objects via untrusted data, potentially leading to remote code execution or other serious impacts.

Exploitability

Exploitation is straightforward for remote attackers since it requires no authentication, user interaction, or special conditions; the flaw exists in a publicly accessible deserialization path.

Blast radius

Successful exploitation could allow full compromise of the affected WordPress site—including data theft, site defacement, or use as a pivot point for further attacks—due to the CVSS 9.8 severity and lack of authentication requirements.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Newsletters plugin version 4.18.2 or later, which contains the vendor's fix for the object injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.