CyberRota Analysis
AI-GeneratedThe Newsletters WordPress plugin versions prior to 4.17 are vulnerable due to the insecure generation of API keys, which are derived from a publicly known value. This flaw allows unauthenticated attackers to compute the API key and execute privileged actions, including adding or deleting subscribers and sending emails, if the optional API feature is enabled. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential exploitation.
Original NVD Description
The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails, when the optional API has been enabled.