EUVD-2026-65464
GHSA-hh9m-cqf2-rmcf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible via web form (AV:N), trivial to execute (AC:L), requires author-level login (PR:L); impact is limited integrity via unauthorized email dispatch with no confidentiality or availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to send arbitrary newsletter emails to users of any WordPress role, including administrators, by forging POST fields during a normal post submission. This allows an attacker-supplied role slug via the newsletters_mailinglistsroles POST field to be passed directly to get_users(), enabling unauthorized mass-mailing and potential phishing against privileged site users through the site's own outbound email channel.
AnalysisAI
Authorization bypass in the Newsletters plugin for WordPress (all versions up to and including 4.17) allows authenticated attackers holding at minimum author-level access to send mass emails to any WordPress user role - including administrators - by forging the newsletters_mailinglistsroles POST field during ordinary post submission. The forged role slug is passed unchecked directly to WordPress's get_users() function, enabling the attacker to weaponize the site's own trusted outbound email channel for phishing campaigns targeting privileged accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum author-level role assignment - subscriber and contributor accounts without post publishing capability are insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 base score of 4.3 (Medium) accurately captures the constrained impact: authentication is required (PR:L), the scope is unchanged, and the direct effect is limited integrity impact with no confidentiality or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a legitimate WordPress author account on a target site running Newsletters 4.17 or earlier submits a standard post form while injecting an administrator role slug into the newsletters_mailinglistsroles POST field. The plugin passes this value directly to get_users(), retrieves all administrator accounts, and dispatches the attacker's newsletter content to every admin email address via the site's own outbound mail server - lending the message apparent legitimacy. … |
| Remediation | A fix has been committed to the WordPress Subversion repository as documented in the changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3663788%40newsletters-lite&new=3663788%40newsletters-lite; however, the exact patched release version number is not independently confirmed from the available input data - site administrators should update to the latest available version of the Newsletters plugin from the WordPress plugin repository immediately and verify the installed version exceeds 4.17. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Newsletters
View allwp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPres
Server-Side Request Forgery (SSRF) in the Newsletters WordPress plugin before 4.16 allows unauthenticated remote attacke
PHP object injection in the Newsletters WordPress plugin (all versions before 4.16) permits unauthenticated remote attac
Unauthenticated PHP object injection in the Newsletters WordPress plugin before 4.15 lets remote attackers deserialize a
Unauthenticated time-based SQL injection in the Newsletters plugin for WordPress (versions up to and including 4.13) all
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newslette
Authentication bypass in the Newsletters WordPress plugin (all versions before 4.16) allows remote unauthenticated attac
The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2
Cross Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters.9.7. Rated high severity (CVSS 8.8), this vulne
Reflected cross-site scripting in the Tribulant Software Newsletters (newsletters-lite) WordPress plugin, affecting all
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive syste
The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's newsletters_video sho
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today