This vulnerability in Tribulant Software Newsletters (<= 4.11) arises from unsafe deserialization of untrusted data, enabling object injection attacks. An attacker can exploit this remotely without authentication or user interaction, potentially executing arbitrary code or causing denial of service. The CVSS 3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability. No known exploits in the wild or vendor patches have been reported yet.

Successful exploitation can lead to full system compromise, including arbitrary code execution, data breach, and service disruption. The vulnerability affects all installations of Tribulant Software Newsletters up to version 4.11. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the affected plugin to mitigate risk.