5.4
Moyenne
CVE-2026-17522 The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its…
Description
The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Newsletters 4.17 | premières → < 4.17 | 4.17 |
Autres CVE de Newsletters
Les 8 CVE de Newsletters →
CVE-2026-16264
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber…
6.5
Moyenne
CVE-2026-17520
The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source,…
4.8
Moyenne
CVE-2026-16269
The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing…
4.8
Moyenne
CVE-2026-16267
The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from…
8.1
Élevée