CVE-2026-12583 Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field
Unauthenticated attackers can inject PHP objects via subscriber fields to execute arbitrary code and write files on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12583?
CVE-2026-12583 is a high-severity unsafe deserialization vulnerability in Unknown Newsletters, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.
Weakness: CWE-502
Which versions are affected by CVE-2026-12583?
How do I fix CVE-2026-12583?
No fix has been published for CVE-2026-12583 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-12583 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-12583 exists.
Sources
Also known as GHSA-cxqr-jhpf-63mm.