CVE-2026-16269: Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling
The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/newslettersto a version that resolves this vulnerability.Fixed in 4.16 - Configuration
If you do not require the plugin’s optional API, disable it to prevent unauthenticated API authentication bypass (described for plugin versions before 4.16).
Newsletters WordPress plugin optional API = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16269?
CVE-2026-16269 has a risk score of 62, indicating a medium level of severity.
How do I fix CVE-2026-16269?
To mitigate CVE-2026-16269, update the Newsletters WordPress plugin to version 4.16 or later.
What actions can an attacker perform due to CVE-2026-16269?
An attacker can perform privileged actions, such as modifying subscriber records and sending emails, due to the authentication bypass.
Which versions of the Newsletters plugin are affected by CVE-2026-16269?
CVE-2026-16269 affects all versions of the Newsletters WordPress plugin prior to 4.16.
Is authentication required for exploiting CVE-2026-16269?
No, CVE-2026-16269 allows unauthenticated attackers to exploit the vulnerability without needing authentication.