What is the CVSS score of CVE-2026-54840?

CVE-2026-54840 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Newsletters are affected by CVE-2026-54840?

Your WordPress sites using the Newsletters plugin (versions 4.13 and earlier) are vulnerable to unauthorized access of email subscriber data and administration functions without requiring attacker…

How to fix or mitigate CVE-2026-54840?

Within 24 hours: audit all WordPress instances to identify which use the Newsletters plugin and document affected versions (4.13 and earlier). Within 7 days: either disable the plugin entirely, or deploy Web Application Firewall rules blocking unauthenticated access to plugin endpoints (/wp-json/newsletters/* or equivalent). Within 30 days: monitor the Patchstack advisory for vendor patch release; apply immediately when available.

Newsletters CVE-2026-54840

EUVD-2026-39682 HIGH

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-7hhw-r4mw-8jm8

WordPress Authentication Bypass Wordpress Plugin

7.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Unauthenticated network endpoint with no user interaction (AV:N/AC:L/PR:N/UI:N); missing authorization yields partial, scoped read/modify impact, so C/I/A are Low and scope Unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:37 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.

AnalysisAI

Missing authorization in the Newsletters (newsletters-lite) WordPress plugin through version 4.13 lets unauthenticated remote attackers reach functionality that should be access-controlled, producing limited confidentiality, integrity, and availability impact (CVSS 7.3). Reported by Patchstack and tagged as an authentication bypass, the flaw requires no credentials or user interaction, though no public exploit code or CISA KEV listing exists at time of analysis. The partial (Low) impact across all three dimensions suggests scoped data exposure or unauthorized actions rather than full site compromise.

Technical ContextAI

The affected component is the Newsletters plugin for WordPress (commonly distributed as 'newsletters-lite'), used to build and send email campaigns to subscriber lists. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints or AJAX/REST handlers execute privileged operations without verifying the requester's capability or nonce, so the server-side authorization check that should gate the action is absent or incomplete. Because WordPress plugins frequently register admin-ajax.php actions or REST routes that are reachable pre-authentication, a Broken Access Control gap of this class typically allows anonymous callers to invoke handlers intended only for administrators or logged-in users.

RemediationAI

No vendor-released patch version is identified in the available data; because the advisory designates 4.13 and earlier as vulnerable, a fixed release is expected to be the next version above 4.13, but that version is not confirmed in this input - confirm and apply the patched build via the WordPress plugin updater after checking the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-13-broken-access-control-vulnerability?_s_id=cve). Until a confirmed fixed version is installed, compensating controls include deactivating the Newsletters plugin if email campaigns are not actively in use (trade-off: disables all newsletter functionality), and placing a WAF or web-server rule in front of the affected plugin endpoints - for example restricting the plugin's admin-ajax.php actions and any custom routes to authenticated sessions (trade-off: may break legitimate front-end subscribe flows and requires identifying the exact action names from the advisory). Virtual patching via a WordPress security plugin (e.g. Patchstack's own mitigation) is a reasonable interim control where deactivation is not acceptable.