CVE-2026-119616 in Noptin Plugin
Summary
by MITRE • 11/07/2026
The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptin_fields[first_name]' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The public Manage Preferences page issues a nonce to unauthenticated visitors, meaning there is no effective authorization barrier — an unauthenticated attacker can store the malicious payload as their first_name and have it executed the next time any newsletter is sent by the site operator. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/07/2026
The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress contains a critical Local File Inclusion (LFI) vulnerability affecting all versions up to and including 4.4.3. This flaw is located within the handling of the noptin_fields[first_name] parameter during user registration or profile update processes on the public Manage Preferences page. The core technical issue stems from insufficient input validation and sanitization mechanisms when processing this specific field, which allows an unauthenticated attacker to inject malicious file paths that are subsequently included by the application logic. Because the plugin issues a nonce to unauthenticated visitors for certain actions, there is no effective authorization barrier preventing initial interaction with the vulnerable endpoint, although full exploitation requires subsequent administrative action as detailed below.
From a technical perspective, this vulnerability aligns with CWE-98 Improper Control of Filename for Include/Require in PHP Programs and falls under the broader category of CWE-20 Improper Input Validation. The attacker can store arbitrary content within the first_name field, which is then persisted to the database or file system depending on the plugin's internal handling. When a site administrator triggers an action that processes these stored fields, such as sending out a newsletter notification, the application inadvertently includes and executes the malicious payload embedded in the name field. This mechanism effectively transforms user input into executable PHP code if the environment allows for the inclusion of uploaded or manipulated files. The vulnerability is particularly dangerous because it leverages legitimate administrative workflows to achieve remote code execution, bypassing standard access controls that might otherwise protect sensitive areas of the application.
The operational impact of this vulnerability is severe, as successful exploitation leads directly to Remote Code Execution (RCE) on the affected WordPress server. An unauthenticated attacker can inject PHP code into the first_name field and wait for an administrator to send a newsletter or perform another action that triggers the inclusion logic. Once executed, the injected code runs with the same privileges as the web server process, typically www-data or apache. This allows the attacker to bypass access controls entirely, exfiltrate sensitive data such as database credentials and user information, install backdoors for persistent access, or pivot further into the internal network. The requirement for an administrative action means that while the initial injection is unauthenticated, the final execution relies on social engineering or timing attacks against privileged users who regularly manage newsletter campaigns within the Noptin interface.
This exploitation pattern corresponds to MITRE ATT&CK techniques including T1059 Command and Scripting Interpreter: PHP for code execution and potentially T1190 Exploit Public-Facing Application if viewed as a broader attack vector, though the specific mechanism here is more aligned with stored input manipulation leading to execution. The vulnerability highlights risks associated with storing user-supplied data in fields that are later processed without adequate sanitization before inclusion or output operations. It also underscores the importance of verifying file types and paths when dealing with dynamic includes, even if those includes are triggered by internal application logic rather than direct external requests.
Mitigation strategies should prioritize immediate upgrading to a patched version of the Noptin plugin where this vulnerability has been addressed through rigorous input validation and output encoding practices. Administrators who cannot immediately upgrade should implement strict web application firewall rules that detect and block attempts to inject PHP tags or file path sequences into form fields, particularly those related to user profiles and newsletter preferences. Additionally, restricting the ability of unauthenticated users to submit data via the Manage Preferences page until proper authentication is enforced can reduce the attack surface. Regular auditing of plugin code for similar patterns where user input influences file inclusion operations is recommended to prevent recurrence of such flaws in other components or future versions.