CVE-2026-16269

MediumCVSS 4.8/10Last modified Aug 26, 2026

Description

The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Aug 8, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-16278.1An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of t CVE-2026-162706.9Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When so CVE-2026-162729.1Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module al CVE-2026-162734.6The Narrative Publisher WordPress plugin through 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when re CVE-2026-162742.7The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post CVE-2026-162755.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th CVE-2026-162762.7The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store re CVE-2026-162776.5A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address info CVE-2026-162799.3An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026 CVE-2026-16284.6Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to external sites within the Mattermost app which a CVE-2026-162809.8An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs large CVE-2026-162817.1The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI imag