CVE-2026-54840
Deferred Deferred - Pending Action
Unauthenticated Broken Access Control in Newsletters

Publication date: 2026-06-26

Last updated on: 2026-06-26

Assigner: Patchstack

Description
Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-26
Last Modified
2026-06-26
Generated
2026-06-26
AI Q&A
2026-06-26
EPSS Evaluated
N/A
NVD
CVE-2026-54840
EUVD
EUVD-2026-39682
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack newsletters_lite to 4.13 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The vulnerability involves unauthenticated broken access control allowing unauthorized users to perform higher-privileged actions. Such unauthorized access can lead to unauthorized disclosure, modification, or deletion of data, which may impact compliance with data protection regulations like GDPR and HIPAA that require strict access controls to protect personal and sensitive information.

Since the flaw falls under OWASP Top 10's A1: Broken Access Control, it highlights a critical security weakness that can result in data breaches or unauthorized data manipulation, potentially violating regulatory requirements for data confidentiality, integrity, and availability.

Organizations using affected versions of the Newsletters plugin should update immediately to mitigate risks and maintain compliance with relevant standards and regulations.

Executive Summary

CVE-2026-54840 is a Broken Access Control vulnerability in the WordPress Newsletters Plugin versions 4.13 and below.

This vulnerability allows unauthenticated users to perform actions that normally require higher privileges because the plugin is missing proper authorization checks.

It is classified as medium priority with a CVSS score of 7.3 and falls under the OWASP Top 10 category A1: Broken Access Control.

Impact Analysis

This vulnerability can be exploited by unauthenticated attackers to perform privileged actions on affected websites.

Because there are no authorization checks, attackers could potentially manipulate newsletter functions or other sensitive operations.

The flaw is considered moderately dangerous and could be used in mass campaigns targeting thousands of websites, increasing the risk of widespread exploitation.

Users are strongly advised to update to version 4.14 or seek assistance from hosting providers or developers if updating is not possible.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the WordPress Newsletters Plugin to version 4.14 or later.

If updating is not possible, it is recommended to seek assistance from your hosting provider or a developer.

No virtual patch can be applied due to the nature of the vulnerability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54840. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart