CVE-2026-17522

Newsletters is a WordPress plugin that, in versions before 4.17 , fails to perform any nonce or capability check when saving one of its settings screens. Because it writes every submitted parameter into its own options, an attacker can use a Cross-Site Request Forgery (CSRF) attack to trick a log...