The Newsletters WordPress plugin prior to version 4.16 fails to restrict the classes allowed during PHP unserialisation of data received from a public form submission, enabling an attacker to inject arbitrary PHP objects. This flaw allows unauthenticated users to supply crafted payloads that, when unserialised, can instantiate objects that may expose further vulnerabilities such as code execution or unauthorized data manipulation.

WordPress sites running the Newsletters plugin at any version below 4.16 are affected; the issue originates from the plugin’s handling of date form fields without validating the serialised content.

The EPSS score for this vulnerability is not available and it is not listed in the CISA KEV catalogue, indicating no publicly confirmed exploitation at this time. Weakness CWE‑545 (Object Injection) underpins the flaw, and because the input comes from a public form it is highly likely that an attacker can exploit the vulnerability from any unauthenticated endpoint capable of receiving the same serialized data. The impact ranges from potential execution of arbitrary code to alteration of application state depending on the objects injected.