The Newsletters WordPress plugin prior to version 4.16 fails to restrict the classes allowed during PHP unserialisation of data received from a public form submission, enabling an attacker to inject arbitrary PHP objects. This flaw allows unauthenticated users to supply crafted payloads that, when unserialised, can instantiate objects that may expose further vulnerabilities such as code execution or unauthorized data manipulation.

WordPress sites running the Newsletters plugin at any version below 4.16 are affected; the issue originates from the plugin’s handling of date form fields without validating the serialised content.

The CVSS score of 8.1 and EPSS score of < 1 % classify this vulnerability as high severity with a very low but nonzero exploitation probability; it is not listed in the CISA KEV catalogue, indicating no publicly confirmed exploitation at this time. The weakness CWE-502 (Deserialization of Untrusted Data) underpins the flaw, and because the input comes from a public form it remains highly likely that an attacker can exploit the vulnerability from any unauthenticated endpoint capable of receiving the same serialized data. The impact ranges from potential execution of arbitrary code to alteration of application state depending on the objects injected.