The Tribulant Newsletters plugin is vulnerable to unauthenticated object injection, which poses a critical risk of full system compromise.

This vulnerability is a CWE-502 Deserialization of Untrusted Data flaw occurring within the plugin. The attack vector is network-based and requires no authentication, allowing an attacker to inject malicious objects to achieve remote code execution.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code with the privileges of the web server. This could lead to complete site takeover, unauthorized access to sensitive subscriber databases, and potential lateral movement within the hosting environment. The 9.8 CVSS score reflects the high impact on confidentiality, integrity, and availability.

Immediate Action: Update the Newsletters (newsletters-lite) plugin to version 4.12 or higher immediately.

Proactive Monitoring: Review web server access logs for suspicious POST requests containing serialized PHP objects or anomalous strings in plugin parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common PHP object injection patterns and malicious payloads targeting WordPress plugin vulnerabilities.

Public Exploit Available: Unknown.

This vulnerability is critical due to the ease of exploitation and the potential for full system compromise. Administrators must prioritize updating the Newsletters plugin to version 4.12 immediately. If an immediate update is not feasible, the plugin should be deactivated until remediation can be completed to prevent potential exploitation.