Newsletters settings can be overwritten through cross-site requests
Newsletters before 4.17 saves one settings screen without a nonce or capability check and writes every submitted parameter into plugin options. An attacker can make a logged-in Administrator overwrite arbitrary Newsletters settings, including the credential protecting its API, through a cross-site request.
- Component
- Newsletters
- Plugin slug
newsletters-lite- Affected
- < 4.17
- Safe version
4.17- Published
- Aug 29, 2026
This CVE was published Aug 29, 2026 and is one of 37 known issues for this plugin.
Update, patch or deactivate.
Update to 4.17 or later, rotate the Newsletters API credential, and review plugin settings and administrator activity for unauthorized changes.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L