4.8
Medium
CVE-2026-17520 The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source,…
Description
The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails, when the optional API has been enabled.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Newsletters 4.17 | earliest → < 4.17 | 4.17 |
Other CVEs of Newsletters
The 8 CVEs of Newsletters →
CVE-2026-16264
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber…
6.5
Medium
CVE-2026-17522
The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its…
5.4
Medium
CVE-2026-16269
The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing…
4.8
Medium
CVE-2026-16267
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from…
8.1
High