Executive brief
The Newsletters WordPress plugin is used to manage email subscriber lists and newsletters. A vulnerability allows attackers to trick logged-in administrators into changing plugin settings via a malicious web page, including replacing the API credentials that protect access to sensitive subscriber data. This could enable unauthorized deletion or modification of subscriber records.
Technical details
The plugin lacks nonce verification and capability checks on its settings pages, specifically the API configuration endpoint. An attacker crafts a CSRF payload (a hidden form targeting wp-admin/admin.php?page=newsletters-settings-api) that overwrites arbitrary plugin options when a logged-in administrator visits an attacker-controlled page. Because every submitted parameter is written directly as a plugin option without validation, an attacker can replace the API key and enable the API. The vulnerability requires an authenticated administrator session and user interaction (visiting the malicious page), but impacts all plugin settings. The fix is available in version 4.17.
Affected products
- Newsletters Newsletters before 4.17
Timeline
- 2026-08-27: disclosed
- 2026-08-29: advisory
- 2026-08-27: patched: Fixed in version 4.17