CVE-2026-16269
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Newsletters WordPress plugin before version 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled.
Risk Assessment
An attacker can gain full control over API functions, potentially leading to subscriber data breaches, sending spam or phishing on behalf of the organization, and loss of customer trust.
Recommendation
Update the Newsletters plugin to version 4.16 or later, which includes the strict key comparison fix. If the API is not used, consider disabling it.
Original NVD description (English source)
The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled.