The vulnerability resides in the Newsletters WordPress plugin versions prior to 4.16, where the API authentication key is compared loosely, allowing an attacker to perform type juggling against the key. This results in an unauthenticated bypass of the API authentication mechanism, granting unauthorized access to privileged actions such as modifying subscriber records and sending emails. The weakness is a classic authentication failure and can lead to data tampering, unauthorized notifications, and potentially broader compromise if the plugin is used in conjunction with other vulnerable components. The primary impact is loss of data integrity and confidential information, and the weakness is represented by CWE‑287.

Any installation of the Newsletters WordPress plugin prior to version 4.16 where the optional API feature is enabled is affected. The vendor is listed as "Unknown:Newsletters" in CNA data, so the scope is limited to WordPress sites running this particular plugin revision.

The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating no known widespread exploitation yet. However, the attack vector is inferred to be over the network via HTTP requests to the plugin’s API endpoint, requiring the optional API to be enabled. Given the nature of the flaw – an authentication bypass that allows arbitrary state changes – the potential impact is high. The lack of a public exploit does not diminish the inherent risk, especially for sites with sensitive user data or those relying on the plugin for critical mailing lists.