{"id":"CVE-2026-75908","aliases":["EUVD-2026-65464","GHSA-hh9m-cqf2-rmcf"],"status":"published","title":"Newsletters \u003c= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter","description":"The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to send arbitrary newsletter emails to users of any WordPress role, including administrators, by forging POST fields during a normal post submission. This allows an attacker-supplied role slug via the newsletters_mailinglistsroles POST field to be passed directly to get_users(), enabling unauthorized mass-mailing and potential phishing against privileged site users through the site's own outbound email channel.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00385,"percentile":0.32901,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-08-25T11:27:10Z","modified":"2026-09-28T23:10:00Z","products":[{"vendor":"contrid","product":"newsletters"},{"vendor":"tribulant software","product":"newsletters"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d3eddce-1b41-4a33-8d57-bd594cf06a06?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.17/wp-mailinglist.php#L3957"},{"url":"https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.17/wp-mailinglist.php#L4114"},{"url":"https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.17/wp-mailinglist.php#L3897"},{"url":"https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.17/includes/checkinit.php#L63"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3663788%40newsletters-lite\u0026new=3663788%40newsletters-lite"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75908"},{"url":"https://github.com/advisories/GHSA-hh9m-cqf2-rmcf"}],"sources":{"cve":[{"id":"CVE-2026-75908","title":"Newsletters \u003c= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter","description":"The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to send arbitrary newsletter emails to users of any WordPress role, including administrators, by forging POST fields during a normal post submission. This allows an attacker-supplied role slug via the newsletters_mailinglistsroles POST field to be passed directly to get_users(), enabling unauthorized mass-mailing and potential phishing against privileged site users through the site's own outbound email channel.","status":"published","published":"2026-08-25T11:27:10.516Z","modified":"2026-08-25T18:03:51.392Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:07.260654Z"}],"euvd":[{"id":"EUVD-2026-65464","description":"The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to send arbitrary newsletter emails to users of any WordPress role, including administrators, by forging POST fields during a normal post submission. This allows an attacker-supplied role slug via the newsletters_mailinglistsroles POST field to be passed directly to get_users(), enabling unauthorized mass-mailing and potential phishing against privileged site users through the site's own outbound email channel.","status":"published","published":"2026-08-25T11:27:10Z","modified":"2026-08-25T18:03:51Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:32.174502Z"}],"ghsa":[{"id":"GHSA-hh9m-cqf2-rmcf","title":"The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to,...","description":"The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to send arbitrary newsletter emails to users of any WordPress role, including administrators, by forging POST fields during a normal post submission. This allows an attacker-supplied role slug via the newsletters_mailinglistsroles POST field to be passed directly to get_users(), enabling unauthorized mass-mailing and potential phishing against privileged site users through the site's own outbound email channel.","status":"published","published":"2026-08-25T12:31:24Z","modified":"2026-08-25T12:31:25Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:10:56.831918Z"}],"nvd":[{"id":"CVE-2026-75908","description":"The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to send arbitrary newsletter emails to users of any WordPress role, including administrators, by forging POST fields during a normal post submission. This allows an attacker-supplied role slug via the newsletters_mailinglistsroles POST field to be passed directly to get_users(), enabling unauthorized mass-mailing and potential phishing against privileged site users through the site's own outbound email channel.","status":"published","published":"2026-08-25T12:16:24.927Z","modified":"2026-09-28T23:10:00.143Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:41.347728Z"}]}}