An unauthenticated deserialization vulnerability in the Newsletters WordPress plugin allows remote attackers to inject arbitrary PHP objects, potentially leading to unauthorized code execution.

The plugin fails to restrict the classes allowed when unserializing a value taken from a public form submission. This allows unauthenticated attackers to inject arbitrary PHP objects into the application environment.

With a CVSS score of 8.1, this high-severity vulnerability could lead to significant system compromise. While the impact depends on the availability of a functional gadget chain, successful exploitation may allow for remote code execution, unauthorized data access, or total site takeover.

Immediate Action: Update the Newsletters WordPress plugin to version 4.16 or later immediately.

Proactive Monitoring: Monitor site traffic for unusual requests directed at plugin forms and review web server access logs for signs of object injection attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) with rules configured to block suspicious serialized data patterns in POST requests.

Public Exploit Available: No (unknown).

This vulnerability is highly dangerous because it allows unauthenticated interaction with the application's underlying code execution logic. Administrators should verify their current version of the Newsletters plugin and apply the 4.16 update as a high-priority task to prevent potential exploitation.