CVE-2020-35932

The Newsletter plugin before version 6.8.2 contains an object injection vulnerability in the AJAX handler for 'tnpc_render_callback', which calls the 'restore_options_from_request' function that directly unserializes user-supplied data from the $_POST['options']['inline_edits'] parameter. An attacker with subscriber-level permissions could exploit this by sending a crafted POST request to wp-admin/admin-ajax.php with a malicious serialized object, potentially leveraging magic methods from third-party libraries or other plugins to execute arbitrary code or achieve other critical impacts through a property-oriented programming chain.

Based on public CVE data (MITRE/NVD).