Unrated severityNVD Advisory· Published Aug 6, 2026
Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler
CVE-2026-16268
Description
The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <4.16
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/65612dd4-83d8-40c5-8e12-862e9b5f940b/mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.