CVE-2025-67911
Published: 08 January 2026
Summary
CVE-2025-67911 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-67911 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Newsletters Lite WordPress plugin developed by Tribulant Software. The flaw enables Object Injection and affects all versions of the plugin up to and including 4.11. Published on January 8, 2026, it carries a CVSS v3.1 base score of 9.8, indicating critical severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and high impact on confidentiality, integrity, and availability.
Unauthenticated remote attackers can exploit this vulnerability over the network without privileges or user interaction. Successful exploitation allows object injection via deserialization of untrusted data, potentially leading to arbitrary code execution, data manipulation, or system compromise, as reflected in the high-impact CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-11-php-object-injection-vulnerability?_s_id=cve details the PHP object injection issue in version 4.11 and provides guidance on mitigation, likely including updating to a patched version where available.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1560
Vulnerability details
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through <= 4.11.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote exploitation of public-facing WordPress plugin via deserialization/object injection leading to RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and patching of the deserialization flaw in Newsletters Lite plugin versions up to 4.11 to eliminate the object injection vulnerability.
Mandates validation of untrusted inputs prior to deserialization, directly preventing object injection exploitation in the WordPress plugin.
Deploys boundary protections like web application firewalls to inspect and block network-based deserialization payloads targeting this unauthenticated remote vulnerability.