The Newsletters WordPress plugin prior to version 4.17 derives its API key from a publicly known value instead of a cryptographically secure random source. Because the key calculation is deterministic, an attacker can compute the key without authentication. With the API enabled, the attacker can add and delete subscribers and send emails on the site, effectively gaining privileged control over the mailing list functionality and potentially exposing user data and enabling spam campaigns. The weakness is a predictable random value used for authentication.

Any WordPress installation using the Newsletters plugin with a version older than 4.17 is affected. The vulnerability applies to all systems that expose the optional API endpoint, regardless of the number of users or the site's traffic volume.

The vulnerability allows unauthenticated actors to compute the API key and perform privileged actions, which is a high‑impact flaw. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. However, because the API endpoint is accessible over the Internet and requires no pre‑existing credentials, the attack vector is remote and easy to exploit once the plugin is discovered to be running an affected version. The lack of a current EPSS score does not mitigate the inherent severity, and site owners should treat this as a high‑risk flaw until mitigated.