External risk intelligence

Tribulant Newsletters Lite Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-67911

This vulnerability affects a WordPress plugin, which is typically deployed as part of a public-facing web application. Since web plugins are designed to process inputs from internet users to provide functionality, they are commonly exposed to the public internet in standard deployment patterns.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Tribulant Software's Newsletters Lite plugin, specifically related to the deserialization of untrusted data. This issue could allow for object injection, potentially impacting the integrity and availability of systems that use this plugin. The main concern is confirming relevance and exposure.

Plugin accepts malicious code.
Impacts web applications, needs careful review.
Confirm exposure and assess business risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data over the network to a vulnerable installation of the Newsletters plugin. This data would trigger a deserialization process that allows an attacker to inject malicious objects, potentially leading to code execution or other severe impacts on the affected system.

No authentication or user interaction needed.
Triggered by deserializing untrusted data.
Leads to object injection and potential code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject and execute arbitrary PHP objects when the affected component processes untrusted data. This can occur when the vulnerable component receives and deserializes specially crafted input from a network source, leading to potential compromise of the application and its underlying system.

Remote code execution.
Processing untrusted serialized data.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This deserialization vulnerability in Tribulant Software Newsletters impacts object injection, posing a critical risk. The initial step for relevant teams is to locate all instances of the affected software, ascertain their exposure and business criticality, and identify the accountable owner for remediation planning.

Application owners should manage this issue.
Verify system reachability and business criticality.
Plan remediation based on confirmed exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Tribulant Newsletters Lite plugin?

This is a WordPress plugin used by website administrators to manage email marketing campaigns, subscriber lists, and newsletters directly from their dashboard. It integrates into the WordPress ecosystem to process user data and communications, making it a functional component of web-based content management systems.

What does CVE-2025-67911 mean by deserialization vulnerability?

It refers to CWE-502, a weakness where an application takes untrusted data and turns it back into a complex object without proper validation. By providing specially crafted input, an attacker can manipulate this process to inject malicious objects into the application, which may allow them to execute arbitrary code or alter system operations.

How is this object injection vulnerability triggered?

The issue occurs when the plugin receives and processes malicious serialized data over a network. An attacker does not need to be logged in, nor does a user need to click anything, for the process to be triggered. If the software is not processing specifically prepared, malicious data, the deserialization mechanism functions as intended.

Do I need to worry if my installation is internet-facing?

Yes, you should prioritize this. Halo Surface Signal notes that because this is a WordPress plugin designed to interact with web traffic, it is typically deployed in public-facing environments. This means it is directly reachable by network-based attackers, increasing the likelihood that your system could be targeted if it remains unpatched.

When should I take action for this vulnerability?

You should act immediately by identifying every instance of the Newsletters plugin within your infrastructure. Once located, evaluate the business criticality of those specific sites and determine who is responsible for them. Your goal is to assess whether these instances are exposed to the network and to coordinate with the assigned owners to plan and implement the necessary remediation.

References

patchstack.com/database/Wordpress/Plugin/newsletters-lite/vulnerabil…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.