The Newsletter plugin lacks proper nonce validation in the hook_newsletter_action function, exposing it to Cross‑Site Request Forgery (CWE‑352). An attacker can forge a request that, when a logged‑in user clicks a malicious link, removes a subscriber from the newsletter list without the user’s knowledge. This flaw can erode a site’s subscription base and undermine user trust, though it does not grant code execution or broad system access.

The vulnerability affects all versions of the "Newsletter – Send awesome emails from WordPress" plugin distributed by satollo, specifically releases up through version 9.1.0.

The CVSS score of 4.3 indicates moderate severity, while an EPSS score of less than 1 % suggests a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalogue. Availability of the vulnerability depends on an attacker convincing a legitimate user to visit a crafted URL; the attacker requires no special privileges beyond creating a forged request. The consequence is the irreversible removal of subscribers, which can impact marketing efforts and audience engagement.