CVE-2026-16269

Name of the Vulnerable Software and Affected Versions Newsletters WordPress plugin versions prior to 4.16

Description When the optional API is enabled, the software fails to strictly compare the API authentication key. This allows unauthenticated attackers to bypass authentication using type juggling—a behavior where a language's loose comparison allows different data types to be treated as equal—to perform privileged actions, including modifying subscriber records and sending emails.

Recommendations Update the Newsletters WordPress plugin to version 4.16 or later.