Authorization Bypass Vulnerability in Newsletters Plugin for WordPress

CVE-2026-75908

What is CVE-2026-75908?

The Newsletters plugin for WordPress is affected by a vulnerability that allows authenticated users with author-level access or higher to execute unauthorized actions. This flaw arises because the plugin fails to appropriately verify user permissions, enabling these users to forge POST requests that send arbitrary newsletter emails to any user role, including administrators. By exploiting the unchecked 'newsletters_mailinglistsroles' field, an attacker can manipulate the role slug passed to the get_users() function, facilitating unauthorized mass emails and potential phishing attempts disguised as legitimate communications from the site.

References