The Newsletters WordPress plugin (< 4.17) lacks required nonce or capability checks when saving settings, allowing an attacker to craft a malicious request that an authenticated administrator will unknowingly process. This CSRF flaw writes every submitted parameter into the plugin's options, making it possible to overwrite arbitrary settings, including the API credential that protects the plugin's backend services.

Affected systems are WordPress installations that have the Newsletters plugin installed at any version lower than 4.17, specifically 4.16 and earlier. No other plugins or WordPress versions are affected as stated by the vendor data.

Based on the description, it is inferred that the attack vector requires an authenticated administrator to log in to WordPress and then visit a malicious site that triggers the hidden request, exploiting the missing nonce and capability checks in the Newsletters plugin. The EPSS score is <1%, indicating a low probability of exploitation, while the CVSS score of 5.4 reflects moderate severity. The vulnerability is not listed in CISA KEV. The impact of credential compromise is high, as an attacker can gain full control over the plugin's configuration without additional authentication beyond the logged-in admin session. Administrators should update immediately, as the vulnerability allows complete control of the plugin's configuration without authentication beyond the logged-in session.