CVE-2026-75908: CWE-862 Missing Authorization in contrid Newsletters

CVE-2026-75908 is an authorization bypass vulnerability in the contrid Newsletters WordPress plugin affecting all versions up to and including 4.17. The plugin fails to properly verify user authorization when processing the newsletters_mailinglistsroles POST field during post submissions. This allows authenticated users with author-level privileges or higher to forge POST requests that specify arbitrary user roles, which are then passed directly to the get_users() function. Consequently, attackers can send newsletter emails to any user role, including administrators, facilitating unauthorized mass mailing and potential phishing attacks leveraging the site's own outbound email channel.

The vulnerability enables authenticated users with author-level access or above to bypass authorization controls and send arbitrary newsletter emails to any user role on the WordPress site. This can lead to unauthorized mass mailing and phishing attacks targeting privileged users, including administrators, potentially compromising site security and user trust. There is no direct impact on confidentiality or availability reported, but the integrity of communications and user trust is at risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and monitor for suspicious newsletter activity. Avoid using the vulnerable plugin version and consider disabling the plugin if possible until a patch is released.