The vulnerability stems from an insecure handling of the subscriber field in the Noptin WordPress plugin, allowing an attacker to store PHP code in a first_name field. When the newsletter email is later generated, the plugin includes that stored value as a file path, executing arbitrary PHP code on the server. This flaw grants code execution for an unauthenticated user without modifying server credentials, effectively bypassing existing access controls.

The flaw exists in all installations of picocodes’ Noptin – Newsletter, New Post Notifications & Email Automation plugin up to and including version 4.4.3, which is deployed on WordPress sites.

The CVSS score of 5.9 indicates a moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower overall threat landscape at present. However, the attacker must rely on a site administrator to trigger the newsletter; thus, the risk is contingent on administrator activity. In environments where newsletters are frequently sent, the attack window opens whenever an administrator initiates a campaign.