The newsletters-lite plugin prior to 4.6.8.6 for WordPress has PHP object injection.
tribulant newsletters