CVE-2020-35932: 
NixOS vulnerability analysis and mitigation

Insecure Deserialization in the Newsletter plugin before version 6.8.2 for WordPress affects over 300,000 sites. The vulnerability allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline_edits] parameter (Wordfence Blog).

The vulnerability is tracked as CVE-2020-35932 with a CVSS v3.1 Base Score of 8.8 (HIGH) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The exploitability of this vulnerability depends on PHP objects that might be present with certain other plugins or themes (NVD).

The vulnerability allows authenticated attackers with minimal privileges to inject arbitrary PHP objects, which could lead to remote code execution if specific PHP objects are present in the environment. This affects all versions of the Newsletter plugin prior to 6.8.2 (NVD).

The vulnerability requires authentication with minimal privileges (such as subscriber access). Exploitation involves using the tpnc_render AJAX action to inject arbitrary PHP objects through the options[inline_edits] parameter (Wordfence Blog).

Users should upgrade to Newsletter plugin version 6.8.2 or later to address this vulnerability (NVD).