CVE-2026-17522

Name of the Vulnerable Software and Affected Versions Newsletters WordPress plugin versions prior to 4.17

Description Cross-Site Request Forgery (CSRF) occurs because the plugin fails to perform nonce or capability checks when saving settings screens. This allows an attacker to trick a logged-in administrator into overwriting arbitrary plugin settings, including the credentials used to protect its API, by submitting malicious parameters that are written directly into the plugin options.

Recommendations Update Newsletters WordPress plugin to version 4.17 or later.