CVE-2026-75908 Overview
CVE-2026-75908 is an authorization bypass vulnerability in the Newsletters plugin for WordPress, affecting all versions up to and including 4.17. The plugin fails to verify that a user is authorized to perform mailing list actions. Authenticated attackers with author-level access or above can send arbitrary newsletter emails to users of any WordPress role, including administrators. Exploitation occurs by forging the newsletters_mailinglistsroles POST field during a normal post submission, which is passed directly to get_users(). This enables unauthorized mass-mailing and phishing against privileged site users through the site's own outbound email channel [CWE-862].
Critical Impact
Authenticated author-level users can send arbitrary newsletter emails to administrators and other privileged roles, enabling phishing through the site's trusted email channel.
Affected Products
- WordPress Newsletters plugin (newsletters-lite) versions ≤ 4.17
- WordPress sites permitting author-level or higher registration
- Any WordPress installation running the vulnerable plugin
Discovery Timeline
- 2026-08-25 - CVE-2026-75908 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-75908
Vulnerability Analysis
The Newsletters plugin exposes mailing list functionality through a POST handler processed during standard post submission workflows. The handler accepts a newsletters_mailinglistsroles field from the client without validating the submitter's capability to target arbitrary WordPress roles. The submitted role slug is forwarded directly to the WordPress get_users() function, which returns the full user set for that role. The plugin then dispatches newsletter emails to every returned user. Because delivery originates from the site's own outbound mail channel, recipients see messages that appear to come from a trusted internal source, increasing the effectiveness of any embedded phishing content.
Root Cause
The root cause is a missing authorization check [CWE-862] in the mailing list submission path. The vulnerable code paths reside in wp-mailinglist.php around lines 3897, 3957, and 4114, along with includes/checkinit.php line 63. The plugin trusts client-supplied role slugs and does not confirm that the submitting user has the edit_users or equivalent capability required to mail privileged roles.
Attack Vector
An attacker first obtains author-level access to the target WordPress site through legitimate registration, credential compromise, or account takeover. The attacker then submits a crafted POST request containing the newsletters_mailinglistsroles field set to administrator or another privileged role slug. The plugin processes the request, resolves the recipient set via get_users(), and delivers attacker-controlled newsletter content to the targeted role. The attack requires only network access and low-privilege authentication, with no user interaction.
Refer to the Wordfence Vulnerability Intelligence Report and the WordPress Newsletters Lite changeset for technical details on the vulnerable code paths and the fix.
Detection Methods for CVE-2026-75908
Indicators of Compromise
- Outbound newsletter emails sent from the site to administrator accounts without a corresponding scheduled campaign in the plugin's admin UI.
- POST requests to WordPress post-submission endpoints containing the newsletters_mailinglistsroles parameter with values such as administrator, editor, or other privileged role slugs.
- Newsletter send events initiated by author-level user IDs in the plugin's logs or database tables.
- Unexpected additions or edits to newsletter templates or mailing list role mappings by non-administrator accounts.
Detection Strategies
- Inspect web server access logs for POST bodies containing newsletters_mailinglistsroles= combined with privileged role slug values.
- Correlate WordPress user activity logs with plugin mail-send events to identify author-level accounts triggering role-scoped campaigns.
- Monitor SMTP relay or mail transport logs for spikes in outbound mail volume originating from the WordPress host.
Monitoring Recommendations
- Enable WordPress audit logging with per-user action tracking and alert on non-admin accounts touching newsletter functionality.
- Alert on any newsletter or bulk-mail activity performed by accounts below the edit_users capability threshold.
- Baseline normal outbound mail volume from the WordPress host and flag deviations for review.
How to Mitigate CVE-2026-75908
Immediate Actions Required
- Update the Newsletters plugin to the version released after 4.17 that contains the fix documented in the WordPress Newsletters Lite changeset.
- Audit WordPress user accounts and remove or downgrade unnecessary author-level or higher accounts.
- Review newsletter send history for unauthorized campaigns targeting administrators or editors.
- Rotate credentials for administrator accounts that may have received phishing content through the vulnerable channel.
Patch Information
The vendor addressed the missing authorization check in the changeset published at revision 3663788 for the newsletters-lite plugin. The fix enforces capability verification before accepting client-supplied role slugs in the mailing list submission handler. Site operators must upgrade beyond version 4.17 to receive the patch.
Workarounds
- Deactivate the Newsletters plugin until the patched version is deployed.
- Restrict new user registration and require administrator approval for any role at author level or higher.
- Deploy a web application firewall rule that blocks POST requests containing newsletters_mailinglistsroles when the submitting user does not hold the edit_users capability.
- Isolate the WordPress outbound mail relay so that mail from author-level actions requires additional review before delivery.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
