CVE-2026-75908: Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter
The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to send arbitrary newsletter emails to users of any WordPress role, including administrators, by forging POST fields during a normal post submission. This allows an attacker-supplied role slug via the newslettersmailinglistsroles POST field to be passed directly to getusers(), enabling unauthorized mass-mailing and potential phishing against privileged site users through the site's own outbound email channel.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Newsletters pluginto a version that resolves this vulnerability.Fixed in 4.17 - Configuration
Update the Newsletters plugin so it properly verifies authorization for the action that processes the newsletters_mailinglistsroles POST field; unauthenticated/insufficiently authorized users must not be able to pass arbitrary role slugs through this parameter to get_users().
WordPress Newsletters plugin newsletters_mailinglistsroles (POST parameter) = Reject/ignore attacker-supplied role slugs from newsletters_mailinglistsroles unless the requester is authorized for the specified roles
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with the Author role or a higher-privileged role can exploit it. No user interaction is required from the attacker.
What access does an attacker need to send messages to administrators?
The attacker needs an account that can submit a normal post and can forge POST fields. They can supply a role slug in the newsletters_mailinglistsroles POST parameter to target users in arbitrary WordPress roles, including administrators.
What is the practical impact?
An attacker can use the site's own outbound email channel to send arbitrary newsletter emails to users matching the selected role. This can enable phishing directed at privileged site users, while the CVSS impact is limited to integrity.
Which plugin versions are affected?
All WordPress Newsletters plugin versions through 4.17, including 4.17, are affected.