Tribulant Newsletters WordPress plugin: Cross-site request forgery

Summary

The Newsletters (newsletters-lite) WordPress plugin up to and including version 4.18.2 is affected by a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can trick a logged-in WordPress user into unintentionally performing actions on the site, such as changing settings. Exploitation requires that a privileged user, typically an administrator, visits an attacker-controlled page while logged in. The CNA rates the issue CVSS 9.6, while VulDB rates it 4.3 Medium, and the severity is disputed.

Affected

• Newsletters (newsletters-lite) WordPress plugin by Tribulant Software, versions up to and including 4.18.2
• VulDB also lists 4.18.0 and 4.18.1 as affected

Fixed in

• Unknown. No fixed version is confirmed for this CVE.
• Version 4.18.2 is not confirmed as safe; install the latest release available on WordPress.org and check the Patchstack advisory.

Workaround

• No vendor-specific workaround known.
• Deactivate the plugin if it is not business-critical until an update is confirmed.
• Log out of WordPress administration before browsing other websites.

Exploitation

• No public proof of concept or exploit code is known.
• Not listed in CISA KEV as of the latest check.
• OffSeq lists it as not known to be exploited.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Inventory all WordPress sites with the Newsletters plugin and record the exact version.
• Update to the latest release (at least 4.18.2, which also fixes other critical issues) and verify against the Patchstack advisory.
• Deactivate the plugin where it is not needed until the update is confirmed.
• Enforce two-factor authentication and session hygiene for WordPress administrator accounts.
• Re-check the NVD record, Patchstack and CISA KEV for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• VulDB CVE-2026-116863 vuldb.com
• OffSeq threat radar radar.offseq.com
• WordPress.org Newsletters plugin wordpress.org
• TheHackerWire CVE-2026-116863 www.thehackerwire.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:06.