# CVE-2026-17522: Newsletters WordPress plugin CSRF arbitrary settings update

Source: https://junglewise.ai/threats/cve-2026-17522-newsletters-wordpress-plugin-csrf-arbitrary-settings-update  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-17522 · Severity: medium · CVSS 5.4 · Published 2026-08-29

The Newsletters WordPress plugin is used to manage email subscriber lists and newsletters. A vulnerability allows attackers to trick logged-in administrators into changing plugin settings via a malicious web page, including replacing the API credentials that protect access to sensitive subscriber data. This could enable unauthorized deletion or modification of subscriber records.

## Quick answers

**Is CVE-2026-17522 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17522 being exploited in the wild.

**How severe is CVE-2026-17522?** Medium severity, with a CVSS score of 5.4, published 29 August 2026.

**Which products and versions are affected?** Newsletters Newsletters before 4.17.

**Is there a fix for CVE-2026-17522?** A patch was published on 2026-08-27: Fixed in version 4.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-17522 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-17522?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin lacks nonce verification and capability checks on its settings pages, specifically the API configuration endpoint. An attacker crafts a CSRF payload (a hidden form targeting wp-admin/admin.php?page=newsletters-settings-api) that overwrites arbitrary plugin options when a logged-in administrator visits an attacker-controlled page. Because every submitted parameter is written directly as a plugin option without validation, an attacker can replace the API key and enable the API. The vulnerability requires an authenticated administrator session and user interaction (visiting the malicious page), but impacts all plugin settings. The fix is available in version 4.17.

## Affected products

- Newsletters Newsletters before 4.17

## Timeline

- 2026-08-27: disclosed
- 2026-08-29: advisory
- 2026-08-27: patched: Fixed in version 4.17

## References

- [https://wpscan.com/vulnerability/ebb8d4b7-14b5-49ed-b727-129123d6ce45/](https://wpscan.com/vulnerability/ebb8d4b7-14b5-49ed-b727-129123d6ce45/)