CVE-2026-119616
Deferred Deferred - Pending Action

Local File Inclusion in Noptin WordPress Plugin

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: Wordfence

Description
The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptin_fields[first_name]' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The public Manage Preferences page issues a nonce to unauthenticated visitors, meaning there is no effective authorization barrier — an unauthenticated attacker can store the malicious payload as their first_name and have it executed the next time any newsletter is sent by the site operator. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-119616
EUVD
EUVD-2026-118559

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
picocodes Noptin – Newsletter, New Post Notifications & Email Automation From 0 (inc) to 4.4.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Local File Inclusion (LFI) flaw in the Noptin WordPress plugin up to version 4.4.3. It allows unauthenticated attackers to include and execute arbitrary PHP files on the server by manipulating the 'noptin_fields[first_name]' parameter. The issue arises because the plugin fails to properly validate user input, enabling code execution if PHP files can be uploaded and included.

Detection Guidance

This vulnerability involves Local File Inclusion via the 'noptin_fields[first_name]' parameter in the Noptin WordPress plugin. To detect it, check for unauthorized PHP file inclusions or executions in your WordPress environment. Review server logs for suspicious requests targeting the 'noptin_fields[first_name]' parameter or unusual file access patterns. Ensure the plugin is updated to the latest version to mitigate the risk.

Impact Analysis

An attacker could exploit this to bypass access controls, steal sensitive data, or execute malicious PHP code on your server. They can store a payload in the first_name field, which gets executed when an administrator sends a newsletter. This requires an administrator action but can lead to full server compromise if successful.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA compliance requirements for data protection and access controls. A breach may result in legal penalties, reputational damage, and loss of trust due to compromised personal or health information.

Mitigation Strategies

Update the Noptin plugin to the latest version where the EXTR_SKIP flag is added to prevent variable overwrites in template functions. Remove any unauthorized PHP files in the uploads directory and review user-submitted data like first_name for malicious payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119616. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...