Is CVE-2026-75908 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75908 being exploited in the wild.

How severe is CVE-2026-75908?

Medium severity, with a CVSS score of 4.3, published 25 August 2026.

Which products and versions are affected?

WordPress Plugins Newsletters up to and including 4.17.

Is there a fix for CVE-2026-75908?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-75908 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-75908?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75908: WordPress Newsletters plugin authorization bypass

CVE-2026-75908 · Severity: medium · CVSS 4.3 · Published 2026-08-25

The Newsletters plugin for WordPress has an authorization flaw that allows authenticated authors to send mass emails to any user, including administrators, without proper permission. An attacker with author-level access can bypass security checks and use the site's own email system to conduct phishing attacks or unauthorized communications against privileged users, leveraging their trusted relationship with the domain.

Quick answers

Is CVE-2026-75908 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75908 being exploited in the wild.
How severe is CVE-2026-75908?: Medium severity, with a CVSS score of 4.3, published 25 August 2026.
Which products and versions are affected?: WordPress Plugins Newsletters up to and including 4.17.
Is there a fix for CVE-2026-75908?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-75908 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-75908?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Newsletters plugin fails to properly validate user authorization before performing newsletter send operations. An authenticated attacker with author-level access or above can forge POST fields (specifically the newsletters_mailinglistsroles parameter) during post submission to pass an arbitrary role slug directly to the get_users() WordPress function. This bypasses intended access controls and enables the attacker to send emails to users of any role, including administrators. The vulnerability affects all versions up to and including 4.17 and requires authentication and author-level privileges but no additional user interaction.

Affected products

WordPress Plugins Newsletters up to and including 4.17

Timeline

2026-08-25: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.