The Newsletters plugin for WordPress permits any logged‑in user with author‑level permissions to modify the newsletters_mailinglistsroles POST field, bypassing the plugin’s authorization checks. By supplying an arbitrary role slug, an attacker can invoke get_users() to retrieve all users of that role—including administrators—and trigger the mailing of newsletters to them. This turns the site’s outbound email channel into a vector for mass phishing or spam messages.

WordPress Newsletters plugin (contribid:Newsletters) versions up to and including 4.17 are affected. Sites running these plugin versions, regardless of the WordPress installation or user role structure, are vulnerable.

The CVSS score of 4.3 indicates moderate severity. No EPSS data is available and the vulnerability is not listed in CISA KEV. Exploitation requires an authenticated author or higher role; an attacker can craft a POST request during normal form submission to set newsletters_mailinglistsroles to any desired role. While the impact is limited to unauthorized email sending rather than code execution, the ability to target privileged users makes this a concern for sites with many authoritative accounts.