CVE-2026-17522
Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF
- State
- Published
- Severity
- 5.4 Medium
- Published
- Aug 29, 2026
- Updated
- Aug 30, 2026
- Reserved
- Jul 27, 2026
Description
The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L | CISA-ADP |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
NewslettersUnknown |
|
References
- https://wpscan.com/vulnerability/ebb8d4b7-14b5-49ed-b727-129123d6ce45/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.