CVE-2026-16268
Received Received - Intake

Unauthenticated Server-Side Request Forgery in Newsletters WordPress Plugin

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description
The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-26
AI Q&A
2026-08-06
EPSS Evaluated
2026-08-25
NVD
CVE-2026-16268
EUVD
EUVD-2026-53723

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
newsletter wordpress_plugin to 4.16 (exc)
newsletter_plugin newsletter to 4.16 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the Newsletters WordPress plugin versions before 4.16. It allows attackers to make the website send requests to arbitrary internal or external hosts without authentication by exploiting the SNS Bounce Handler component's lack of request validation.

Detection Guidance

To detect this vulnerability, check if your WordPress site is running Newsletters plugin versions prior to 4.16. You can use commands like 'wp plugin list' in WP-CLI or inspect the plugin version via the WordPress admin dashboard. Monitor server logs for unusual outbound requests to arbitrary hosts.

Impact Analysis

An attacker could exploit this to access internal systems, exfiltrate data, or interact with other services on your network. It may also lead to denial-of-service conditions or unauthorized actions performed on behalf of the vulnerable site.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Immediately update the Newsletters plugin to version 4.16 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review server logs for any suspicious outbound requests that may indicate exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16268. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart