CVE-2026-17522

5.4 Moyenne

Publiée le 29/08/2026 à 08:17 · Modifiée le 31/08/2026 à 22:14 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.

Traduire en français

Produits concernés

Unknown Newsletters

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L`

Faiblesses (CWE)

CWE-352

Références

https://wpscan.com/vulnerability/ebb8d4b7-14b5-49ed-b727-129123d6ce45/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories