Description
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.
Published: 2026-10-27
Score: 9.6 Critical
EPSS: n/a
KEV: No
Impact: Cross Site Request Forgery
Action: Immediate Patch
AI Analysis

Impact

A Cross‑Site Request Forgery vulnerability exists in the Tribulant Software Newsletters Lite plugin up to version 4.18.2. The flaw permits an attacker to force a victim’s browser to submit requests that alter the plugin’s configuration or publish content without the user’s intent.

Affected Systems

WordPress sites running Tribulant Software Newsletters Lite from the first release through 4.18.2. Any version of the plugin up to and including 4.18.2 is affected.

Risk and Exploitability

The CVSS score of 9.6 indicates a high‑severity issue. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a browser‑based CSRF, inferred from the vulnerability type.

Generated by OpenCVE AI on October 27, 2026 at 18:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Newsletters Lite to any release newer than 4.18.2 as soon as the vendor releases a fix.
  • If an upgrade is not immediately possible, deactivate the plugin until the update is applied.
  • If neither action is feasible, limit the plugin’s state‑changing operations to authenticated users or enforce nonce verification to mitigate CSRF risk.

Generated by OpenCVE AI on October 27, 2026 at 18:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Tribulant
Tribulant newsletters
Wordpress-extensions
Wordpress-extensions newsletters
Vendors & Products Tribulant
Tribulant newsletters
Wordpress-extensions
Wordpress-extensions newsletters

Tue, 27 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.
Title WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Subscriptions

Tribulant Newsletters
Wordpress-extensions Newsletters
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-27T15:57:41.805Z

Reserved: 2026-10-27T00:20:51.130Z

Link: CVE-2026-116863

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T16:17:30.543

Modified: 2026-10-27T16:17:30.543

Link: CVE-2026-116863

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T19:00:08Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)