Critical vulnerability in Newsletters Lite plugin for WordPress

WordPress

What happened

A critical vulnerability in the Newsletters Lite plugin for WordPress can lead to object injection due to untrusted data deserialization.

Are you affected?

The software affected includes the Newsletters Lite plugin for WordPress, specifically versions up to 4.18.1.

What to do now

1. Upgrade to a patched version of the Newsletters Lite plugin when available.
2. Monitor official channels for updates on this vulnerability.
3. Review your usage of this plugin and consider temporarily disabling it if running an affected version.

Sources

• cve.now/CVE-2026-94075
• cve.now/GHSA-rfh9-4r53-w9wc
• CVE-2026-94075
• GHSA-rfh9-4r53-w9wc
• https://nvd.nist.gov/vuln/detail/CVE-2026-94075
• https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-1-php-object-injection-vulnerability?_s_id=cve
• cve.now/GHSA-RFH9-4R53-W9WC
• GHSA-RFH9-4R53-W9WC

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.