Newsletters Plugin CVE-2026-17520

The Newsletters plugin's optional API feature must be explicitly enabled by the site administrator - this is not the default state, and sites that have never activated the API are not exposed. Once the API is active, exploitation requires no authentication (PR:N per CVSS vector) but does require the attacker to successfully derive the API key from a publicly known value (AC:H), meaning some reconnaissance or computation effort is necessary. Exploitation is limited to the three privileged actions exposed by the API: adding subscribers, deleting subscribers, and sending emails. There is no path to arbitrary code execution or confidentiality breach based on available data. The key limiting factors for defenders are: API feature disabled by default, and the computational step required to derive the key.

The CVSS base score of 4.8 (Medium) reflects a genuinely bounded risk profile. Attack Complexity is rated High (AC:H) because an attacker must first identify the specific public value used as the key seed and successfully compute it before any exploitation is possible - this is not a trivial or automated-spray condition. The optional API must also be deliberately enabled by the site operator, substantially narrowing the exploitable population to a subset of all Newsletters deployments. EPSS at 0.10% (1st percentile) confirms that observed exploitation in the wild is negligible relative to all tracked CVEs at time of analysis. The absence of a CISA KEV entry further indicates no confirmed active exploitation campaign. The publicly available WPScan proof-of-concept lowers the skill threshold for a targeted attack, which is the primary risk escalation signal here. Impact is bounded to subscriber list manipulation and unauthorized bulk email sending (I:L/A:L); CVSS explicitly records no confidentiality exposure (C:N). For operators with the API enabled, this represents a legitimate and urgent patching priority given the POC availability; for those who have never activated the API feature, exposure is nil.

An attacker targeting a WordPress site running Newsletters with the API enabled identifies the publicly known value used as the key seed - potentially retrievable from the site's public-facing metadata or WordPress installation artifacts - computes the API key offline using the same derivation algorithm, then authenticates to the plugin's API to send phishing emails to the subscriber list or purge it. A publicly available proof-of-concept from WPScan reduces the technical barrier for this attack sequence.