The MDirector Newsletter WordPress plugin contains a Cross‑Site Request Forgery vulnerability in all releases up to and including 4.5.8. The flaw arises from the mdirectorNewsletterSave function lacking a nonce check, which allows an unauthenticated attacker to forge a request that changes the plugin’s settings when a site administrator unknowingly submits the request. Altering these settings can redirect email campaigns, enable spam, or affect other administrative functions, compromising the integrity of the WordPress site.

The vulnerability affects the MDirector Newsletter WordPress plugin developed by antevenio. All versions from the initial release through 4.5.8 are impacted. Neither the 4.5.9 release nor any newer versions contain the fix.

With a CVSS score of 4.3 the vulnerability is considered moderate; the EPSS score of less than 1 % indicates a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a social‑engineering scenario in which an attacker tricks a site administrator into clicking a crafted link that submits the forged request using the victim’s authenticated session.