Description

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-29T06:17:12.290Z",
  "pubdate": "2026-08-29T06:17:12.290Z",
  "executiveSummary": "The Newsletters WordPress plugin is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability that permits unauthorized configuration modification.\nThe flaw stems from a lack of nonce validation and capability verification within the plugin's settings saving mechanism.\nThis vulnerability allows an unauthenticated attacker to manipulate a logged-in administrator into performing unauthorized actions.\nBy coercing an administrator to visit a malicious site or interact with a crafted link, an attacker can overwrite arbitrary plugin settings, including sensitive API credentials.\nThe impact includes the potential for full service compromise, unauthorized data access, or the redirection of plugin communications to attacker-controlled infrastructure.\nThis issue affects all versions of the Newsletters WordPress plugin prior to 4.17.",
  "technicalDetails": "The vulnerability resides in the backend settings handler of the Newsletters plugin, which fails to implement security nonces or session-based capability checks during the form submission process. In a secure WordPress environment, administrative actions involving data modification must be protected by a cryptographic nonce—a unique, time-limited token—to ensure the request originated from a legitimate administrative interface rather than an external source.\nThe root cause is an insecure implementation of the plugin's 'save' routine for its settings screens. The plugin logic accepts POST requests containing arbitrary parameters and indiscriminately writes these values into the WordPress options table. Because the plugin does not verify the identity or authorization of the request sender, it treats any valid administrative session as a trigger to update its internal configuration.\nThe attack flow follows a typical CSRF pattern: 1) The attacker crafts a malicious webpage or email containing a hidden form or an automated script that points to the Newsletters plugin's settings-saving endpoint. 2) The attacker baits a logged-in WordPress administrator into interacting with this malicious content. 3) The victim's browser, authenticated via their existing administrative session, automatically appends the victim's authentication cookies to the forged request. 4) The plugin processes the forged request, lacking any nonce validation to detect that the request is out-of-context. 5) The plugin updates the target configuration fields with the attacker-supplied parameters.\nA significant risk associated with this vulnerability is the ability to modify critical operational settings, such as API keys or remote service endpoints. By overwriting these credentials, an attacker can gain control over data sent through the plugin or redirect sensitive information to an external server under their control. Since the plugin is configured to save all parameters sent to it, the attack surface effectively covers every configurable setting within the plugin, leading to complete unauthorized administrative control over the plugin’s functionality without requiring the attacker to authenticate directly into the WordPress environment."
}