Newsletters uses a predictable API key
Newsletters before 4.17 derives its API key from a publicly known value instead of a sufficiently random source. When the optional API is enabled, an unauthenticated attacker can compute the key and perform privileged operations such as adding or deleting subscribers and sending email.
- Component
- Newsletters
- Plugin slug
newsletters-lite- Affected
- < 4.17
- Safe version
4.17- Published
- Aug 29, 2026
This CVE was published Aug 29, 2026 and is one of 37 known issues for this plugin.
Update, patch or deactivate.
Update to 4.17 or later, rotate the Newsletters API key, and review subscriber changes and outbound campaigns generated through the API.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails, when the optional API has been enabled.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L