CVE-2026-54840: WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability
Published Jun 26, 2026
·Updated
Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.
Affected Software
1 affected component
WordPress Newsletters<=4.13
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Newsletters pluginto a version that resolves this vulnerability.Fixed in 4.14
Event History
Jun 26, 2026
CVE Published
via MITRE·02:52 PM
Data Sourced
via MITRE·02:52 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-54840?
The severity of CVE-2026-54840 is rated high with a score of 7.3.
2
What is CVE-2026-54840?
CVE-2026-54840 is a Broken Access Control vulnerability in WordPress Newsletters plugin versions up to 4.13.
3
How do I fix CVE-2026-54840?
To fix CVE-2026-54840, update the WordPress Newsletters plugin to version 4.14 or later.
4
Can CVE-2026-54840 be exploited remotely?
Yes, CVE-2026-54840 can be exploited remotely due to its unauthenticated nature.
5
What impact can CVE-2026-54840 have on my website?
CVE-2026-54840 can lead to unauthorized access to sensitive data on your website.