CyberRota Analysis
AI-GeneratedThe Newsletters WordPress plugin prior to version 4.17 is vulnerable to Cross-Site Request Forgery (CSRF) attacks due to the lack of nonce or capability checks when saving settings. This flaw allows authenticated attackers to overwrite critical plugin settings, including API credentials, potentially compromising the integrity of the WordPress site. WordPress administrators using this plugin should prioritize updating to the latest version to mitigate the risk of unauthorized configuration changes.
Original NVD Description
The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.