CVE-2026-16269 is an improper authentication vulnerability (CWE-287) in the Newsletters WordPress plugin before version 4.16. The plugin does not strictly compare its API authentication key, which allows attackers to bypass authentication checks through type juggling. This bypass enables unauthorized users to execute privileged API actions, including modifying subscriber data and sending emails, if the optional API feature is enabled.

An attacker can bypass API authentication without valid credentials, leading to unauthorized modification of subscriber records and sending of emails. This could result in unauthorized access to subscriber data and potential misuse of the email sending functionality. The CVSS score of 4.8 indicates a medium severity impact with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the optional API feature if it is not required to reduce exposure. Monitor for updates from the plugin vendor regarding an official fix.