The Newsletters plugin includes an insecure use of PHP include/require with insufficient validation of the filename. This flaw allows certain inputs to cause the plugin to read or execute local files. If an attacker can influence the include path, they may read sensitive configuration files or execute arbitrary code within the WordPress environment. The weakness is classified as CWE‑98, Local File Inclusion.

Tribulant Software’s Newsletters plugin for WordPress, version 4.10 and earlier, is vulnerable. The issue applies to all releases from the initial version through 4.10. Users deploying an affected version on a WordPress installation are at risk.

The vulnerability carries a CVSS score of 7.5, indicating high severity. The EPSS score of less than 1 % reflects a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the flaw can be leveraged over HTTP by sending a crafted request to the plugin’s endpoint that processes file names, leading to local file inclusion. An attacker with access to the application can exploit the local file inclusion to read local files or execute code within the context of the WordPress site.