CVE-2026-16268 is a CWE-918 SSRF vulnerability in the Newsletters WordPress plugin versions prior to 4.16. The flaw arises because the plugin processes bounce requests without authentication or validation, enabling attackers to supply arbitrary URLs that the server will fetch. This can lead to unauthorized internal or external network requests initiated by the vulnerable server, potentially exposing internal resources or enabling further attacks. No official patch or remediation level has been confirmed as of the published date.

An unauthenticated attacker can exploit this vulnerability to make the affected server perform arbitrary HTTP requests to internal or external hosts. This can lead to information disclosure (confidentiality impact rated low) and potentially high integrity impact depending on the internal services accessed. There is no direct availability impact reported. The vulnerability could be leveraged to access internal network resources not otherwise reachable by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling bounce-processing features or restricting network access from the server to untrusted hosts to mitigate exploitation risk.