Newsletters WordPress CVE-2026-16269

Exploitation requires that the Newsletters plugin's optional API feature be explicitly enabled by the WordPress site administrator - this is a non-default configuration. Sites running the plugin without the API enabled are not affected. The attack is fully network-accessible and requires no authentication (PR:N per CVSS), but the specific type-juggled payload must be crafted to match PHP's loose comparison behavior against the stored API key. No user interaction is required. Impact is limited to subscriber data integrity and email dispatch; there is no pathway to read private subscriber data (C:N), execute code, or escalate to WordPress admin. The high attack complexity (AC:H) reflects both the non-default API prerequisite and the payload crafting requirement.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L scores 4.8 (Medium). The AV:N and PR:N metrics confirm network-accessible, unauthenticated exploitation, but AC:H reflects two compounding conditions: the non-default API must be enabled, and a specifically crafted type-juggled payload is required. Impact is bounded - no confidentiality loss (C:N), only limited integrity (subscriber data modification) and availability (email dispatch). EPSS at 0.19% (9th percentile) aligns with low real-world exploitation activity despite a publicly available POC from WPScan. There is no CISA KEV listing. The practical risk profile is: moderate for sites that have explicitly enabled the Newsletters API, negligible for default installations. The gap between a public POC and a low EPSS score suggests the attack is technically feasible but has not been mass-automated. No conflicting signals between CVSS and the description - the AC:H accurately captures the non-default prerequisite.

A publicly available proof-of-concept documents the attack via WPScan. An attacker enumerates a target WordPress site, confirms the Newsletters plugin API is reachable, and submits a crafted HTTP request carrying a type-juggled API key value - a string that PHP's loose == comparison evaluates as equal to the stored key. Authentication is bypassed, and the attacker can issue privileged API calls to bulk-modify subscriber records or trigger mass email sends, potentially weaponizing the site's mailing infrastructure for spam or phishing campaigns.