CVE-2026-17520: Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key

Q: Which deployments are exposed?

Deployments using a Newsletters plugin version before 4.17 are exposed only when the plugin's optional API is enabled.

Q: What does an attacker need to exploit this issue?

An attacker does not need to authenticate. They can compute the API key because it is derived from a publicly known value rather than a sufficiently random source.

Q: What could an attacker do with the computed key?

They could perform privileged API actions, including adding or deleting subscribers and sending emails.

Published Aug 29, 2026

Updated

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails, when the optional API has been enabled.

Affected Software

1 affected component

WordPress Newsletters plugin<4.17

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Newsletters WordPress plugin to a version that resolves this vulnerability.
Fixed in 4.17
Compensating control
If the optional API is not required, ensure the Newsletters plugin API is disabled to prevent unauthenticated access while using a version before 4.17.

Event History

Aug 29, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using a Newsletters plugin version before 4.17 are exposed only when the plugin's optional API is enabled.

What does an attacker need to exploit this issue?

An attacker does not need to authenticate. They can compute the API key because it is derived from a publicly known value rather than a sufficiently random source.

What could an attacker do with the computed key?

They could perform privileged API actions, including adding or deleting subscribers and sending emails.

CVE-2026-17520: Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What could an attacker do with the computed key?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What could an attacker do with the computed key?