Executive brief
The Newsletters plugin for WordPress has an authorization flaw that allows authenticated authors to send mass emails to any user, including administrators, without proper permission. An attacker with author-level access can bypass security checks and use the site's own email system to conduct phishing attacks or unauthorized communications against privileged users, leveraging their trusted relationship with the domain.
Technical details
The Newsletters plugin fails to properly validate user authorization before performing newsletter send operations. An authenticated attacker with author-level access or above can forge POST fields (specifically the newsletters_mailinglistsroles parameter) during post submission to pass an arbitrary role slug directly to the get_users() WordPress function. This bypasses intended access controls and enables the attacker to send emails to users of any role, including administrators. The vulnerability affects all versions up to and including 4.17 and requires authentication and author-level privileges but no additional user interaction.
Affected products
- WordPress Plugins Newsletters up to and including 4.17
Timeline
- 2026-08-25: disclosed