CVE-2026-119616picocodes Noptin file inclusion

What it is

Input chooses which file the application includes and runs.

How it is reached

An attacker can exploit it over the network, without an account, but someone has to act first, such as opening a file or following a link. Success also depends on conditions the attacker does not fully control.

What an attacker gains

A successful attack can read the data it protects. In practice, this kind of flaw lets an attacker run commands or code with the privileges of the affected service.

Is it being exploited?

There is no public report of exploitation yet.

What to do

1. No fixed version is listed yet. Find every place picocodes Noptin runs, watch the references for a fix, and plan a replacement if it is no longer supported.
2. While there is no fix, keep it off the internet or behind a VPN, allowlist or authenticating proxy.
3. Warn the people who use it, and filter files and links on the way in.

Description from NVD

The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.4.3 via the 'noptin_fields[first_name]' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The public Manage Preferences page issues a nonce to unauthenticated visitors, meaning there is no effective authorization barrier — an unauthenticated attacker can store the malicious payload as their first_name and have it executed the next time any newsletter is sent by the site operator. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.