Local File Inclusion Vulnerability in Noptin Newsletter Plugin for WordPress

CVE-2026-119616

What is CVE-2026-119616?

The Noptin plugin for WordPress is affected by a Local File Inclusion vulnerability that permits unauthenticated attackers to manipulate the 'noptin_fields[first_name]' parameter. This flaw can lead to the inclusion and execution of arbitrary .php files on the server. While the vulnerability requires an administrator to trigger the execution of the malicious payload, an attacker can exploit the system by storing harmful code in the first_name parameter, which could be executed during the sending process of newsletters. This scenario poses significant risks for bypassing access controls and potentially exposing sensitive data.

References