PULSE
LIVE7signals / 24h
ES
FEED
ransomincransom reclama a Louisville Bar Association · US · Professional Servicesransomqilin reclama a Clausing · DE · Manufacturingransomqilin reclama a CLLS Co Ltd · SG · Not Foundransomstorm reclama a United Group of Companies · US · Otherransomstorm reclama a Sawyer Savings Bank · US · Financial Servicesransombravox reclama a MEDICOS · FR · Healthcareransomspacebears reclama a Hitech Distribuzione Informatica S.r.l. (HTDI) · IT · Technologyransomstorm reclama a Pioneer Bank · US · Financial Servicesransomthegentlemen reclama a Hartfiel Automation · DE · Manufacturingransomqilin reclama a Astro Electroplating · US · Manufacturingransomqilin reclama a Filtronic · GB · Manufacturingransomqilin reclama a EISNER ZT GMBH · AT · Professional Servicesransomqilin reclama a John C Saunders, CPA · US · Professional Servicesransomqilin reclama a Nikan Awasisak Agency · CA · Not Foundransomincransom reclama a Louisville Bar Association · US · Professional Servicesransomqilin reclama a Clausing · DE · Manufacturingransomqilin reclama a CLLS Co Ltd · SG · Not Foundransomstorm reclama a United Group of Companies · US · Otherransomstorm reclama a Sawyer Savings Bank · US · Financial Servicesransombravox reclama a MEDICOS · FR · Healthcareransomspacebears reclama a Hitech Distribuzione Informatica S.r.l. (HTDI) · IT · Technologyransomstorm reclama a Pioneer Bank · US · Financial Servicesransomthegentlemen reclama a Hartfiel Automation · DE · Manufacturingransomqilin reclama a Astro Electroplating · US · Manufacturingransomqilin reclama a Filtronic · GB · Manufacturingransomqilin reclama a EISNER ZT GMBH · AT · Professional Servicesransomqilin reclama a John C Saunders, CPA · US · Professional Servicesransomqilin reclama a Nikan Awasisak Agency · CA · Not Found
← All CVEs
CVE WatchAug 8, 2026

CVE-2026-16267

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submi

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Aug 8, 2026 · Last modified: Aug 8, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.

Official references
Related CVEs

No related CVEs by CWE or product.