CVE-2026-17520

Published: Aug 29, 2026Modified: Aug 31, 2026Deferred

4.8

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Exploitability: 2.2 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails, when the optional API has been enabled.

Related CWEs

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (1)

https://wpscan.com/vulnerability/5a719e6b-22e1-4950-bf17-cd92e2ea6685/

Source: contact@wpscan.com

Timeline

No history available yet.