CVE-2026-75908
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Newsletters plugin for WordPress up to version 4.17 is vulnerable to authorization bypass. Authenticated attackers with author-level access and above can send arbitrary newsletter emails to users of any WordPress role, including administrators, by forging POST fields during a normal post submission. The attacker can supply a role slug via the newsletters_mailinglistsroles POST field, enabling unauthorized mass-mailing and potential phishing.
Risk Assessment
An attacker can use the site's trusted email channel to conduct phishing attacks against privileged users, potentially leading to admin account compromise and overall site security breach.
Recommendation
Upgrade the Newsletters plugin to a version later than 4.17 that includes the authorization verification fix.
Other vulnerabilities in Newsletters
See all- CVE-2026-17522Low risk· EPSS 1%
The Newsletters WordPress plugin before version 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options. This allows attackers to make a logged-in administrator overwrite arbitrary plugin settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.
- CVE-2026-17520Low risk· EPSS 1%
The Newsletters WordPress plugin before version 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value. This allows unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails, when the optional API has been enabled.
- CVE-2026-16269Medium
The Newsletters WordPress plugin before version 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled.
- CVE-2026-16267High
The Newsletters WordPress plugin before version 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.
- CVE-2026-57394High
The Newsletters plugin for WordPress (versions up to 4.14) is vulnerable to reflected XSS. Improper input neutralization during web page generation allows injection of malicious scripts.
- CVE-2026-3018High
The Newsletters plugin for WordPress up to version 4.13 is vulnerable to time-based SQL injection via the 'wpmlsubscriber_id' parameter. Insufficient escaping and lack of proper SQL query preparation allow unauthenticated attackers to append additional SQL queries, potentially extracting sensitive information from the database.
Original NVD description (English source)
The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to send arbitrary newsletter emails to users of any WordPress role, including administrators, by forging POST fields during a normal post submission. This allows an attacker-supplied role slug via the newsletters_mailinglistsroles POST field to be passed directly to get_users(), enabling unauthorized mass-mailing and potential phishing against privileged site users through the site's own outbound email channel.