CVE-2026-57645

9th percentile — higher than 9% of all known CVEs

The vulnerability in the Newsletters plugin up to version 4.13 allows unauthorized access to subscriber management functions. The lack of proper access control enables an attacker to manipulate subscriber data without required permissions.

The risk involves unauthorized reading, modification, or deletion of subscriber lists, potentially leading to user privacy breaches and loss of system trust.

Immediately update the Newsletters plugin to version 4.14 or later, which includes a fix for the broken access control vulnerability.