CVE-2026-16267 is a deserialization of untrusted data vulnerability (CWE-502) in the Newsletters WordPress plugin prior to version 4.16. The plugin unserializes data taken from public form submissions without restricting the classes that can be instantiated, enabling unauthenticated attackers to inject arbitrary PHP objects. This flaw can lead to potential code execution or other impacts depending on the injected objects and the plugin's internal handling. No CVSS score or detailed vendor advisory information is currently available, and no patch or official remediation guidance has been published yet.

The vulnerability allows unauthenticated attackers to inject arbitrary PHP objects through unsafe deserialization, which can lead to remote code execution or other malicious actions depending on the context. The exact impact depends on how the plugin processes the injected objects, but such vulnerabilities generally pose a high risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable functionality if possible and monitor for updates from the plugin vendor.