What is GHSA-mx7c-44xm-6gm6?

GHSA-mx7c-44xm-6gm6 is a security advisory published by GitHub Security Advisories with Medium severity. The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when...

Which CVE IDs does GHSA-mx7c-44xm-6gm6 cover?

GHSA-mx7c-44xm-6gm6 covers the following CVE IDs: CVE-2026-17522. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mx7c-44xm-6gm6?

GHSA-mx7c-44xm-6gm6 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-mx7c-44xm-6gm6MediumCVSS 5.4

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when...

Vendor

GitHub Security Advisories

Published

August 29, 2026

Last Modified

August 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-17522 →

📋 Description

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-17522
https://wpscan.com/vulnerability/ebb8d4b7-14b5-49ed-b727-129123d6ce45
https://github.com/advisories/GHSA-mx7c-44xm-6gm6