CVE-2026-17520

The record

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails, when the optional API has been enabled.

Affected packages

Related vulnerabilities

• CVE-2026-112026 A security vulnerability has been detected in light0011 cms… CWE-326
• CVE-2026-77405 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-326
• CVE-2026-86670 A flaw has been found in aircheng-org iWebShop-5 up to 5.15. CWE-326
• CVE-2026-47842 Applications using AesBytesEncryptor with the two-argument constructor or when passing a… CWE-326
• CVE-2026-79084 Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to… CWE-326
• CVE-2026-74889 openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in… CWE-326
• CVE-2026-65777 Inadequate encryption strength in Windows Active Directory allows an authorized attacker… CWE-326
• CVE-2026-9201 IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute… CWE-326