The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.
Des templates Nuclei sont disponibles pour scanner cette vulnérabilité.
nuclei -t http/cves/2026/CVE-2026-16268.yaml -u target.com