CVE-2026-75908

Executive Summary

CVE-2026-75908 is an authorization bypass vulnerability in the Newsletters plugin for WordPress, affecting all versions up to and including 4.17. The flaw allows authenticated attackers with author-level privileges or above to send arbitrary newsletter emails to any WordPress user regardless of role — including administrators — by forging POST fields during a normal post submission. An attacker-supplied role slug passed via the newsletters_mailinglistsroles POST field is passed directly to get_users(), enabling mass-mailing abuse and phishing campaigns against privileged site users through the site's own trusted outbound email channel. The vulnerability is currently unpatched (patch confidence 0/4), with a CVSS base score of 4.3 (Medium), and no public exploit code exists at the time of this writing.

Technical Analysis

Vulnerability Class

The vulnerability is classified under CWE-862 — Missing Authorization. This is a logic-level flaw in which the plugin fails to verify that the authenticated user is entitled to perform a privileged action (sending bulk newsletter emails). No authentication bypass is present — the attacker must already be authenticated. However, the plugin trusts client-supplied input to determine the scope of the action, rather than deriving that scope from the authenticated user's actual capabilities or stored role memberships.

Attack Mechanism

The core issue is a role/recipient scoping manipulation flaw. During a standard post submission workflow (e.g., saving a post via the WordPress admin or the REST API), the plugin reads a POST field named newsletters_mailinglistsroles. This field carries a role slug (e.g., administrator, editor, subscriber). The plugin passes that attacker-controlled slug directly to the WordPress function get_users() as a query argument.

Because the plugin does not:

1. Sanitize or whitelist the role slug against a fixed set of allowed roles.
2. Verify that the authenticated author-level user has permission to target the specified role.
3. Cross-check the submitted role slug against the user's own role hierarchy.

…an attacker can supply administrator as the role slug, causing get_users() to return all users in the administrator role. The plugin then uses that returned user list as the recipient list for the newsletter send. The sending itself is performed through the site's own email infrastructure (WordPress wp_mail() or a plugin-specific SMTP channel), which means the email originates from the legitimate domain — bypassing SPF/DKIM-related phishing filters that would normally flag a third-party sender.

Attack Surface

• Entry point: WordPress post submission endpoint (admin post.php / admin-ajax or REST API, depending on the plugin's implementation; exact endpoints not disclosed in the CVE description).
• Precondition: Authenticated user with at least author-level WordPress capabilities (role author or higher).
• Target: Any WordPress user role, notably administrator.
• Channel: The site's legitimate outbound email channel. This is significant because email authentication (SPF, DKIM, DMARC) will validate, making the phishing emails indistinguishable from legitimate site mailings at the transport level.

Why the CVSS Score Is Low (4.3)

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N reflects:

• Availability impact: None — the vulnerability does not disrupt service.
• Confidentiality impact: None — no data is read or exfiltrated.
• Integrity impact: Low — legitimate platform functionality (email sending) is abused, but no data is modified, deleted, or corrupted.
• No user interaction required — the attack chain completes automatically once the malicious post is submitted.

Notably, the CVSS score does not account for the reputational damage and phishing risk against privileged users, which may be significantly higher in practice than the 4.3 mid-range score suggests.

Exploitation Scenarios

Scenario 1: Mass Phishing Against Administrators

Step 1 — Reconnaissance / Target Identification: The attacker identifies a WordPress site running the vulnerable Newsletters plugin (version ≤ 4.17). This can be done via fingerprinting — checking for the plugin directory path /wp-content/plugins/newsletters/ in the page source or probing the readme file. No public shodan dorks are confirmed, but standard WordPress plugin enumeration applies.

Step 2 — Privilege Acquisition: The attacker must have author-level access or higher. This could be:

• A compromised author/contributor account (stolen credentials).
• A legitimate author account acting maliciously (insider threat).
• An account acquired via a separate lower-severity vulnerability.

Step 3 — Exploitation Trigger: The attacker composes a normal WordPress post (or leverages any post-submission workflow that the Newsletters plugin hooks into). During submission, the attacker forges an additional POST parameter: newsletters_mailinglistsroles=administrator. The plugin reads this value and passes it directly to get_users('role=administrator'), retrieving the full list of site administrators.

Step 4 — Payload Execution / Mass Mailing: The plugin sends the newsletter email (containing the attacker's content — e.g., a phishing link) to every address in the returned user list. The email is sent from the site's own mail server, passing SPF/DKIM/DMARC checks. Recipients see a legitimate-looking email from their own domain.

Step 5 — Post-Exploitation Impact: Administrators receive phishing emails that appear to come from their own site. If the email contains a credential-harvesting link (fake login page) or malware attachment, a targeted administrator may be compromised. The attacker can then pivot to full site takeover, data exfiltration, or supply-chain attacks on the WordPress environment.

Scenario 2: Mass Spam / Reputation Damage

Variant: The attacker targets subscriber or customer roles to send spam en masse. The integrity impact is low per CVSS, but the business impact can be material:

• Bulkmailer blacklisting of the domain/IP.
• Customer trust erosion.
• Regulatory exposure under anti-spam legislation (CAN-SPAM, GDPR, PECR where applicable).

Detection note: No public PoC is available; the attack chain is inferred from the vulnerability class and the cleartext mention of the newsletters_mailinglistsroles POST field in the NVD description. The POST field name is the only technical detail disclosed and should be used as the key forensic indicator.

Impact Assessment

Key nuanced risk: Because emails are sent from the site's own outbound channel, even mature email filtering (SPF, DKIM, DMARC, gateway anti-phishing) will not flag these messages as spoofed. Only content-level analysis or reputation scoring of embedded URLs will catch the phishing.

Detection Guidance

Sigma Rule

title: WordPress Newsletters Plugin Authorization Bypass - Forged Role Slug
id: c4476ae4-4e5f-4af4-a9d1-8e3a5f23d941
status: experimental
description: Detects POST submissions to WordPress containing the newsletters_mailinglistsroles parameter with high-privilege role slugs by users with author-level capabilities.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75908
author: Valtersit Threat Intelligence
date: 2026/01/15
tags:
    - attack.t1098
    - cve.2026-75908
    - cwe.862
logsource:
    product: web
    service: wordpress
    category: application
detection:
    selection_payload:
        http.method: POST
        http.url|contains: 'wp-admin/post.php'
    selection_role:
        http.form_data|contains: 'newsletters_mailinglistsroles'
    selection_privileged_role:
        http.form_data|contains|any:
            - 'administrator'
            - 'super_admin'
    selection_author_level:
        http.user|contains: 'role=author'
        # Field reflects the authenticated user's assigned role; adjust per log schema
    condition: selection_payload and selection_role and selection_privileged_role
    timeframe: 5m
level: high
falsepositives:
    - Legitimate newsletter sends to administrators by trusted admin users (unlikely in practice, as admins typically use the plugin's own UI, not direct post submission)

YARA Rule

rule CVE_2026_75908_Newsletters_Role_Forging
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP POST payloads containing forged newsletters_mailinglistsroles role slug targeting privileged WordPress roles"
        cve = "CVE-2026-75908"
        cwe = "CWE-862"
        date = "2026-01-15"
    strings:
        $field = "newsletters_mailinglistsroles" ascii wide nocase
        $admin = "administrator" ascii wide nocase
        $super = "super_admin" ascii wide nocase
        $editor = "editor" ascii wide nocase
        $post_path = "post.php" ascii wide nocase
        $wp_admin = "wp-admin" ascii wide nocase
    condition:
        uint16(0) == 0x0A0D and
        #field >= 1 and
        filesize < 5MB and
        (#admin >= 1 or #super >= 1 or #editor >= 1) and
        ($post_path or $wp_admin)
}

Note: YARA is best suited for inspecting captured .har files, web server access logs (HTTP headers/body), or WAF request dumps. For live traffic, use the Suricata rule.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-75908 WordPress Newsletters Plugin Authorization Bypass - Forged Role Slug"; flow:to_server,established; content:"POST"; http_method; content:"wp-admin"; http_uri; content:"post.php"; http_uri; content:"newsletters_mailinglistsroles"; http_client_body; content:"administrator"; http_client_body; sid:2026759081; rev:1; reference:cve,2026-75908; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-75908; classtype:attempted-admin; priority:1;)

Rule logic: Only triggers when the forged field appears in the HTTP request body of a wp-admin/post.php request AND the administrator role slug is present. The content:"POST"; http_method; and flow direction (to_server) constrain the match to outbound attack traffic.

Elastic Detection

EQL Rule:

sequence by host.name, user.name
  with maxspan=5m
  [
    network where
      network.direction == "egress" and
      network.protocol == "http" and
      destination.port == 80 or destination.port == 443
  ]
  [
    http where
      http.request.method == "POST" and
      url.path == "/wp-admin/post.php" and
      http.request.body.content contains "newsletters_mailinglistsroles" and
      (http.request.body.content contains "administrator" or
       http.request.body.content contains "super_admin")
  ]
  [
    process where
      event.action == "email-send" or
      winlog.event_id == 1 and process.name : "php*"
  ]

Alternative — pure audit-log EQL (no process required):

any where
  event.category == "web" and
  http.request.method == "POST" and
  url.path == "/wp-admin/post.php" and
  http.request.body.content contains "newsletters_mailinglistsroles" and
  http.request.body.content contains "administrator" and
  user.roles contains "author"

Note: EQL rules for web requests vary by Elastic integration. The first rule assumes you have web/auditd/process telemetry; the second works if the HTTP integration captures request bodies.

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=*wordpress*
    method=POST
    uri_path="/wp-admin/post.php"
    form_data="*newsletters_mailinglistsroles*"
    (form_data="*administrator*" OR form_data="*super_admin*")
| eval is_author=if(match(user_info, "author"), 1, 0)
| where is_author=1
| stats count by src_ip, user, uri, _time
| sort -_time

Alternative — searches web server body logs:

index=web body="*newsletters_mailinglistsroles*administrator*"
| eval is_post=if(method="POST", 1, 0)
| where is_post=1
| eval is_author=if(match(user_role, "author"), 1, 0)
| where is_author=1
| table _time, src_ip, user, uri_path, http_user_agent

Wazuh OSSEC Rule

<group name="wordpress,">
    <rule id="206970" level="12">
        <decoded_as>json</decoded_as>
        <field name="http.method">POST</field>
        <field name="url" type="pcre2">/wp-admin/post\.php</field>
        <field name="http.request.body" type="pcre2">newsletters_mailinglistsroles</field>
        <field name="http.request.body" type="pcre2">administrator|super_admin</field>
        <description>CVE-2026-75908: WordPress Newsletters plugin authorization bypass - forged role slug to target privileged users.</description>
        <mitre>
            <id>T1098</id>
        </mitre>
        <group>wordpress,attack,exploitation</group>
        <info>Possible mass phishing or newsletter abuse via forged newsletters_mailinglistsroles POST field.</info>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. The vendor/plugin name has not been officially disclosed beyond "Newsletters plugin for WordPress"; the specific distribution channel (wordpress.org, premium, or custom) is unknown. This means:

1. No fixed version exists that can be upgraded to.
2. No vendor advisory has been published.
3. No workaround has been officially recommended.

Immediate Mitigations (while unpatched)

Patch / Upgrade Steps

• Monitor vendor channels for a patched version (> 4.17). No ETA exists.
• Check the WordPress plugin repository or the vendor's site for changelog/release notes. When a patch is released:
  • Back up the WordPress installation and database.
  • Update to the patched version.
  • Verify all users can still send legitimate newsletters.
  • Re-test with the forged newsletters_mailinglistsroles parameter to confirm the fix blocks it.

Long-Term Hardening

• Enable file-integrity monitoring (e.g., Wazuh FIM, Tripwire) on /wp-content/plugins/newsletters/ to detect tampering.
• Apply principle of least privilege — WordPress author and contributor roles should be rare, monitored, and required to use MFA.
• Review all plugins for similar get_users() misuse patterns during code audits. The flaw class is server-side input validation / authorization logic and is common in WordPress mail/notification plugins.
• Deploy a spam/abuse monitoring system to alert on unusual bulk-email volume per site.
• Subscriber/user data compliance: if newsletter recipient email lists were exposed to unauthorized senders, consider mandatory breach reporting under applicable privacy regulations.

What NOT to Do

• Do not assume the plugin will auto-update — it is not listed as actively maintained in the patch-sources metadata.
• Do not rely on CVSS 4.3 as justification to deprioritize — the phishing risk against admins warrants immediate attention despite the low-to-medium score.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-75908 (Authoritative description, CVSS vector, CWE classification.)
2. CWE-862 — Missing Authorization (MITRE): https://cwe.mitre.org/data/definitions/862.html
3. ATT&CK T1098 — Account Manipulation (MITRE): https://attack.mitre.org/techniques/T1098/
4. WordPress Plugin Security Best Practices (WordPress.org): https://developer.wordpress.org/plugins/security/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-75908 is NOT listed on CISA KEV as of this report; no in-the-wild evidence is documented.)

Threat Actor / Exploit-in-the-Wild Evidence

• CISA KEV: No.
• Public PoC / Exploit code: None identified.
• Nuclei template: Not available.
• Active campaigns: None documented at the time of writing. The vulnerability's existence is confirmed via NVD, but exploitation has not been publicly observed.

Final Assessment Statement

CVE-2026-75908 is an unpatched, medium-severity authorization-bypass flaw in the WordPress Newsletters plugin (≤ 4.17). The attack requires low-privilege authenticated access (author-level) and enables forging of the newsletters_mailinglistsroles POST field to mass-send emails to privileged users, including administrators, via the site's trusted email channel. The primary risk is credential phishing and reputational damage, which the CVSS formula underweights. Immediate mitigation is recommended: disable the plugin or restrict author-level access until a patch is released.

Report generated by Valtersit Threat Intelligence. Confidence in analysis: Medium-High. Based solely on the CVE intelligence data provided.