High Security Advisory Disclosed 2026-10-26
Identity withheld until 2027-01-24 (90 days). The maintainer/vendor was notified on 2026-10-26 and has a 90-day window to remediate before the affected software is named. This page is unlisted and not indexed until then. codelake never stores raw secrets.
Advisory · CLR-2026-3683

Unauthenticated code execution chain in an unmaintained WordPress newsletter plugin

A public form handler invokes attacker-chosen class names via call_user_func, and the plugin's autoloader builds include paths from the same input — an unauthenticated code-execution chain (exploitation complexity: high). The vendor will be notified under a 90-day coordinated-disclosure window; details are revealed automatically on the reveal date.

HighCoordinated disclosure
Summary

an unmaintained WordPress newsletter plugin handles a public form action by passing a request-supplied class name to call_user_func. The plugin's autoloader then builds an include path from that same input without filtering directory separators, so a crafted value can load an attacker-reachable PHP file — an unauthenticated code-execution chain (complexity: high). A second, authenticated sink lets any logged-in user invoke existing view-class methods without a nonce. The affected release is current release.

The plugin is unmaintained; site owners should migrate away.

Technical detail
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.
Remediation
🔒
Technical detail withheld until 2027-01-24 (90 days). The affected package, version, vulnerability class and remediation are public on this page. The exact code location, sink and reproduction are held back to limit exploitation while the issue is unpatched, and are revealed automatically once the coordinated-disclosure window closes.

Reported by codelake Research (https://research.codelake.dev) under coordinated disclosure. The affected software's identity and the exact technical detail are withheld until the reveal date to limit exploitation of an unpatched issue, then revealed automatically.