The Newsletters WordPress plugin contains a Local File Inclusion vulnerability that allows authenticated users with Administrator privileges to specify the 'file' parameter and include arbitrary files on the server. This inclusion can execute PHP code, enabling attackers to bypass access controls, steal sensitive data, or run any code they place into uploaded or otherwise accessible files. The flaw is a classic path traversal and file inclusion issue known as CWE‑22.

WordPress sites running the Newsletters plugin version 4.9.9.9 or earlier are affected. The vulnerability applies to all installations of the plugin up to and including 4.9.9.9, regardless of other installed plugins or themes.

The CVSS score of 7.2 indicates a high potential impact, while the EPSS score of less than 1% suggests a low current threat of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Successful exploitation requires possession of an Administrator account and the ability to manipulate the 'file' parameter, typically by uploading a crafted file or navigating to a specific URL. Once exploited, the attacker can achieve remote code execution on the web server.