EUVD-2026-54730
GHSA-5mfh-c59g-8688
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
AC:H reflects non-default API prerequisite and payload crafting requirement; PR:N because bypass circumvents authentication; C:N as no data can be read.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
5DescriptionCVE.org
The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled.
AnalysisAI
Authentication bypass in the Newsletters WordPress plugin (all versions before 4.16) allows remote unauthenticated attackers to gain privileged API access via PHP type juggling against a non-strict key comparison. Exploitation is conditional on the plugin's optional API being enabled, but when active, attackers can modify subscriber records and send bulk emails without any credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Newsletters plugin's optional API feature be explicitly enabled by the WordPress site administrator - this is a non-default configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L scores 4.8 (Medium). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A publicly available proof-of-concept documents the attack via WPScan. An attacker enumerates a target WordPress site, confirms the Newsletters plugin API is reachable, and submits a crafted HTTP request carrying a type-juggled API key value - a string that PHP's loose == comparison evaluates as equal to the stored key. … |
| Remediation | Upgrade the Newsletters WordPress plugin to version 4.16 or later, which resolves the authentication bypass by replacing the loose comparison operator with strict equality (===) for API key validation; this is the vendor-released patch per the WPScan advisory at https://wpscan.com/vulnerability/8b09afba-16a5-4d6c-9e85-84433a3c0d66/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Newsletters
View allwp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPres
Server-Side Request Forgery (SSRF) in the Newsletters WordPress plugin before 4.16 allows unauthenticated remote attacke
PHP object injection in the Newsletters WordPress plugin (all versions before 4.16) permits unauthenticated remote attac
Unauthenticated PHP object injection in the Newsletters WordPress plugin before 4.15 lets remote attackers deserialize a
Unauthenticated time-based SQL injection in the Newsletters plugin for WordPress (versions up to and including 4.13) all
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newslette
The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2
Cross Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters.9.7. Rated high severity (CVSS 8.8), this vulne
Reflected cross-site scripting in the Tribulant Software Newsletters (newsletters-lite) WordPress plugin, affecting all
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive syste
The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's newsletters_video sho
The Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "to" parameter in all versi
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today