CVE-2026-17520

CVE-2026-17520 affects the Newsletters WordPress plugin prior to 4.17 . The root cause is that the plugin generates its API key from a publicly known value rather than a sufficiently random source, making it predictable. When the optional API feature is enabled, an unauthenticated attacker can co...

EUVD-2026-68045

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails,...