CVE-2026-17522

Deferred Deferred - Pending Action

Unauthenticated CSRF in Newsletters WordPress Plugin

Publication date: 2026-08-29

Last updated on: 2026-08-30

Assigner: WPScan

Description

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-29

Last Modified

2026-08-30

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-17522

EUVD

EUVD-2026-68046

Affected Vendors & Products

Vendor	Product	Version / Range
newsletter	newsletters	to 4.17 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects the WordPress plugin Newsletters before version 4.17. It allows attackers to perform Cross-Site Request Forgery (CSRF) attacks to overwrite arbitrary plugin settings without proper authorization. The plugin fails to check for nonce or capability validation when saving settings, enabling logged-in administrators to be tricked into changing critical options, including API credentials.

Detection Guidance

Check the installed version of the Newsletters WordPress plugin. If it is below 4.17, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

Attackers could exploit this to modify plugin settings, potentially disabling security features or stealing sensitive data like API credentials. If an administrator is tricked into clicking a malicious link, the attacker could gain control over the plugin's functionality, leading to unauthorized access or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements or HIPAA's security rules. If exploited, it may result in unauthorized disclosure of personal or health data, leading to legal penalties and compliance failures.

Mitigation Strategies

Update the Newsletters plugin to version 4.17 or later immediately. Remove unnecessary admin privileges and review plugin settings for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-17522. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70