EUVD-2026-68046
GHSA-mx7c-44xm-6gm6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
PR:N because the attacker needs no credentials; I:H because overwriting API credentials fully compromises plugin integrity beyond a minor settings change.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.
AnalysisAI
Cross-Site Request Forgery in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated attackers to overwrite arbitrary plugin settings - including API credentials - by tricking a logged-in administrator into submitting a crafted request. The vulnerability arises from a complete absence of nonce verification and capability checks on the settings-save endpoint, meaning the plugin blindly applies every submitted parameter. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site has the Newsletters plugin installed and active in any version before 4.17. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 base score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L is broadly consistent with the threat model - network-reachable, low complexity, no attacker privileges required, but dependent on administrator interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Newsletters WordPress plugin to version 4.17 or later, which introduces proper nonce verification and capability checks on the settings-save endpoint. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Newsletters
View allwp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPres
Server-Side Request Forgery (SSRF) in the Newsletters WordPress plugin before 4.16 allows unauthenticated remote attacke
PHP object injection in the Newsletters WordPress plugin (all versions before 4.16) permits unauthenticated remote attac
Unauthenticated PHP object injection in the Newsletters WordPress plugin before 4.15 lets remote attackers deserialize a
Unauthenticated time-based SQL injection in the Newsletters plugin for WordPress (versions up to and including 4.13) all
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newslette
Authentication bypass in the Newsletters WordPress plugin (all versions before 4.16) allows remote unauthenticated attac
Predictable API key generation in the Newsletters WordPress plugin (versions before 4.17) enables unauthenticated networ
The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2
Cross Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters.9.7. Rated high severity (CVSS 8.8), this vulne
Reflected cross-site scripting in the Tribulant Software Newsletters (newsletters-lite) WordPress plugin, affecting all
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive syste
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today