Newsletters WordPress Plugin CVE-2026-17522

Exploitation requires that the target WordPress site has the Newsletters plugin installed and active in any version before 4.17. A logged-in WordPress administrator must be socially engineered into visiting an attacker-controlled page or clicking a malicious link while their admin session is active - this is the UI:R constraint in the CVSS vector. No special plugin configuration is required; the vulnerable endpoint is accessible by default on all affected installations. The limiting factors are the required active admin session and the social engineering step; there is no path to exploitation without administrator interaction, which meaningfully reduces mass-exploitation risk relative to unauthenticated RCE classes.

The CVSS 5.4 base score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L is broadly consistent with the threat model - network-reachable, low complexity, no attacker privileges required, but dependent on administrator interaction. The UI:R requirement is the primary limiting factor: exploitation requires social engineering an active admin session. The EPSS score of 0.10% (1st percentile) confirms no widespread automated exploitation pattern at time of analysis, and CISA KEV status has not been assigned. That said, the existence of a publicly available POC (via WPScan) meaningfully lowers the bar for targeted attacks. The ability to overwrite API credentials is arguably underscored by the I:L rating - credential replacement can fully compromise the plugin's external integrations and represents a higher practical integrity impact than the score suggests. No conflicting signals are present, but administrators at organizations with automated email campaigns or sensitive newsletter audiences should treat this as a priority patch rather than a deferred fix.

An attacker crafts a hidden HTML form on an attacker-controlled website that targets the Newsletters plugin settings endpoint, pre-populating fields with attacker-chosen values including a substituted API credential. A lure (phishing email, malicious ad, forum link) is used to direct a logged-in WordPress administrator to the page; the browser automatically submits the cross-origin request with the admin's session cookie attached. A publicly available POC confirms the technical feasibility of this attack, making it executable by low-skill threat actors.