The Newsletter - API v1 and v2 addon plugin for WordPress contains a missing authorization vulnerability (CWE-862) due to a PHP type juggling issue in the check_api_key function. This issue affects all plugin versions up to 2.4.5 when running on PHP versions below 8.0. Exploitation allows unauthenticated attackers to perform subscriber management actions such as listing, creating, or deleting newsletter subscribers. The vulnerability is network exploitable without privileges or user interaction, with a CVSS 3.1 base score of 6.5 (medium severity). No known exploits in the wild or official patches have been documented at this time.

An attacker can bypass authorization controls to manage newsletter subscribers, potentially leading to unauthorized disclosure of subscriber lists and unauthorized modification or deletion of subscriber data. This could impact confidentiality and integrity of subscriber information. There is no indication of availability impact. The vulnerability only affects sites running PHP versions below 8.0 and using affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider upgrading the PHP environment to version 8.0 or higher, where the vulnerability does not apply. Additionally, restrict access to the API endpoints to trusted networks or authenticated users as a temporary mitigation.