Insufficient Randomness in API Key Generation of Newsletters by WordPress
CVE-2026-17520
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 29 August 2026
Badges
What is CVE-2026-17520?
The Newsletters plugin for WordPress, prior to version 4.17, is susceptible to a vulnerability that arises from the inadequate randomness in its API key generation process. The API key is derived from a publicly known value, which allows unauthenticated attackers to predict the key. This opens the door for malicious actors to perform privileged actions, including adding and deleting subscribers or sending emails through the plugin when the API is enabled, potentially compromising user data and undermining the integrity of the newsletter service.
Affected Version(s)
Newsletters 0 < 4.17
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.