CyberRota Analysis
AI-GeneratedThe Newsletters WordPress plugin prior to version 4.15 is vulnerable to deserialization of untrusted input, enabling unauthenticated attackers to inject PHP objects through public forms. This flaw allows attackers to write arbitrary files and execute code on the server, posing a significant risk to the integrity and security of affected WordPress installations. Website administrators using this plugin should prioritize updating to the latest version to mitigate potential exploitation.
Original NVD Description
The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.