CVE-2026-17520: CWE-326 Inadequate Encryption Strength in Newsletters

CVE-2026-17520 affects the Newsletters WordPress plugin versions prior to 4.17. The plugin generates its API key from a predictable, publicly known value rather than a sufficiently random source. This cryptographic weakness allows unauthenticated attackers to derive the API key, enabling them to perform privileged operations including managing subscribers and sending emails via the plugin's optional API. The vulnerability is categorized under CWE-326 for inadequate encryption strength. There is no vendor advisory or patch information available at this time, and no known exploits have been reported in the wild.

An attacker who can compute the API key can perform unauthorized privileged actions such as adding or deleting newsletter subscribers and sending emails through the plugin's API. This can lead to unauthorized manipulation of subscriber lists and potential abuse of the email sending functionality. The vulnerability does not impact confidentiality but affects integrity and availability of the newsletter service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the optional API feature to prevent exploitation. Monitor official Newsletters plugin channels for updates and apply any forthcoming patches promptly.