WordPress Newsletters CVE-2026-75908

Exploitation requires an authenticated WordPress session with at minimum author-level role assignment - subscriber and contributor accounts without post publishing capability are insufficient. The Newsletters plugin (any version up to and including 4.17) must be installed and active on the target site, and outbound email must be configured and functional for the phishing payload to be delivered. The specific trigger is submission of a POST request with a forged newsletters_mailinglistsroles field targeting a privileged role slug such as 'administrator'. Exploitation is bounded by the requirement for a valid author-level credential, meaning the attack cannot be conducted anonymously; however, on WordPress sites with multiple contributors, author accounts are commonly provisioned and this credential requirement is a modest barrier. The impact is restricted to unauthorized email dispatch - no code execution, credential theft, or file system access is possible through this vector alone.

The official CVSS 3.1 base score of 4.3 (Medium) accurately captures the constrained impact: authentication is required (PR:L), the scope is unchanged, and the direct effect is limited integrity impact with no confidentiality or availability consequences. The network attack vector (AV:N) and low complexity (AC:L) confirm remote exploitability without specialized conditions. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. Despite the moderate score, the real-world phishing risk is meaningfully higher than the number suggests: abusing the site's own trusted email infrastructure to deliver attacker-crafted content to administrator inboxes bypasses many external spam filters and erodes trust in internal communications. The practical barrier is lower than it appears on multi-author WordPress sites where author accounts are routinely provisioned for content contributors, meaning the PR:L prerequisite is not a strong limiting factor in those environments. EPSS data absence prevents probability calibration, and the absence from KEV should not be read as confirmation of no exploitation - only that CISA has not yet observed confirmed cases.

An attacker holding a legitimate WordPress author account on a target site running Newsletters 4.17 or earlier submits a standard post form while injecting an administrator role slug into the newsletters_mailinglistsroles POST field. The plugin passes this value directly to get_users(), retrieves all administrator accounts, and dispatches the attacker's newsletter content to every admin email address via the site's own outbound mail server - lending the message apparent legitimacy. No public exploit code has been identified at time of analysis, but the technique is directly reproducible from the referenced source code at wp-mailinglist.php lines 3897, 3957, and 4114.