CVE-2026-75908

Name of the Vulnerable Software and Affected Versions Newsletters versions prior to 4.18

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with author-level access or higher can send arbitrary newsletter emails to users of any WordPress role, including administrators. This is achieved by forging POST fields during a standard post submission, where an attacker-supplied role slug via the newsletters mailinglistsroles POST field is passed directly to the get users() function. This flaw enables unauthorized mass-mailing and potential phishing against privileged users using the site's own outbound email channel.

Recommendations Update Newsletters to version 4.18 or later.