Missing authorization in contrid Newsletters
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to send arbitrary newsletter emails to users of any WordPress role, including administrators, by forging POST fields during a normal post submission. This allows an attacker-supplied role slug via the newsletters_mailinglistsroles POST field to be passed directly to get_users(), enabling unauthorized mass-mailing and potential phishing against privileged site users through the site's own outbound email channel.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-75908
- 2026-10-03 Alias added: GHSA-hh9m-cqf2-rmcf
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1d3eddce-1b41-4a33-8d57-bd594cf06a06?source=cve
- https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.17/wp-mailinglist.php#L3957
- https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.17/wp-mailinglist.php#L4114
- https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.17/wp-mailinglist.php#L3897
- https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.17/includes/checkinit.php#L63
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3663788%40newsletters-lite&new=3663788%40newsletters-lite
More contrid vulnerabilities
- TI-2023-04414 Newsletter Lite < 4.9.3 - Admin+ Command Injection CVSS 3.1HIGH 7.2
- TI-2014-04458 Unrestricted file upload vulnerability in the Tribulant Slideshow Gallery plugin before… CVSS 2.0MEDIUM 6.5
- TI-2018-14949 The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection. CVSS 3.0CRITICAL 9.8
- TI-2018-12822 SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via… CVSS 3.0CRITICAL 9.8
- TI-2019-10994 wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters… CVSS 3.1HIGH 8.8
- TI-2026-02607 Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter CVSS 3.1HIGH 7.5
Sources
- CVE-2026-75908 · CVE Program
- CVE-2026-75908 · NVD
- FIRST EPSS
- GHSA-hh9m-cqf2-rmcf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences