CVE-2026-116863

WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability

At a glance

Severity: CRITICAL 9.6
State: PUBLISHED
Published: 2026-10-27
Updated: 2026-10-27
Assigner: Patchstack
NVD status: Received

Description

Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	Patchstack
CVSS 3.1	CRITICAL 9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	NVD · audit@patchstack.com (Secondary)

Weaknesses (CWE)

CWE-352

European references

ENISA EUVD · EUVD-2026-111144
GCVE · GCVE-0-2026-116863

Affected products

Product	Versions
Tribulant Software · Newsletters	affected 0 ≤ 4.18.2

References

https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD