CVE-2026-17522: CWE-352 Cross-Site Request Forgery (CSRF) in Newsletters

The Newsletters WordPress plugin versions prior to 4.17 lack proper nonce and capability verification on one of its settings screens. This flaw allows an attacker to submit crafted requests that overwrite arbitrary plugin settings when an administrator is logged in and visits a malicious page. The vulnerability enables modification of sensitive configuration, including API credentials, through a Cross-Site Request Forgery attack.

An attacker can cause a logged-in administrator to unknowingly change critical plugin settings, potentially compromising the integrity and security of the newsletter system. This may lead to unauthorized access or disruption of newsletter functionality. However, no direct confidentiality impact is indicated, and exploitation requires administrator interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid visiting untrusted sites while logged into WordPress with administrative privileges and consider implementing additional CSRF protections or restricting access to the plugin settings page.