The Newsletter plugin for WordPress versions up to 9.1.0 is vulnerable to CSRF due to improper nonce validation in the hook_newsletter_action() function. An attacker can exploit this by crafting a malicious request that, when executed by a logged-in user, causes the unsubscription of newsletter subscribers without their consent. This vulnerability does not require authentication but relies on user interaction (UI:R). The CVSS base score is 4.3, indicating medium severity with network attack vector and low complexity.

The vulnerability allows unauthorized modification of newsletter subscription status by forcing logged-in users to perform unwanted unsubscribe actions. There is no direct impact on confidentiality or availability, but integrity is affected as attackers can manipulate subscription data without authorization. No known exploits are reported in the wild.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about clicking on untrusted links while logged into WordPress with this plugin installed. Implementing nonce validation or other CSRF protections in the plugin code is recommended once a patch is released.