The vulnerability is a deserialization flaw that allows PHP Object Injection when untrusted data is processed by the WordPress Newsletters plugin. This flaw enables an attacker to create a crafted serialized payload that the plugin deserializes without proper validation, potentially leading to arbitrary code execution on the server. The weakness is identified as CWE‑502, Improper Input Validation, and can compromise confidentiality, integrity, and availability of the affected application.

The affected product is the Tribulant Software Newsletters WordPress plugin, commonly referred to as Newsletters Lite. All releases up to and including version 4.18.1 are vulnerable. Any WordPress site that has this plugin installed and is using one of those versions is at risk.

The CVSS base score for this issue is 9.8, classified as Critical. The EPSS score is currently not available, but the lack of a KEV listing does not diminish the potential impact. The most likely attack vector is remote: an attacker can send the malicious serialized data to the plugin’s endpoint over HTTP/HTTPS. Successful exploitation would allow the attacker to execute arbitrary PHP code on the host, with the same privileges that the web server runs with. Given the high severity and the ease of exploitation when the plugin is installed, administrators should treat this as an urgent threat.