CVE-2026-116863: WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-27 · updated 2026-10-29
Weakness: CWE-352

Description

Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.

Summary

A critical CSRF vulnerability (CVSS 9.6) affects the Tribulant Software Newsletters plugin for WordPress through version 4.18.2, allowing attackers to trick logged-in users into performing unintended actions. The flaw is not listed in CISA KEV and no active exploitation has been reported. Update the plugin to a version later than 4.18.2 once available, and in the meantime restrict admin access and review plugin settings.

تؤثر ثغرة CSRF حرجة (CVSS 9.6) في إضافة Newsletters من Tribulant Software لمنصة WordPress حتى الإصدار 4.18.2، وتتيح للمهاجم خداع المستخدمين المسجلين لتنفيذ إجراءات غير مقصودة. لا ترد الثغرة في قائمة CISA KEV ولم يُبلَّغ عن استغلال نشط لها. يُنصح بالتحديث إلى إصدار أحدث من 4.18.2 فور توفره، وإلى حين ذلك تقييد وصول المسؤولين ومراجعة إعدادات الإضافة.

Affected products

Tribulant Software Newsletters: through 4.18.2

References

https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Get alerted when CVE-2026-116863 or the next vulnerability affects your stack