The Newsletters WordPress plugin is affected by a critical Server-Side Request Forgery vulnerability that enables unauthenticated attackers to perform unauthorized server-side requests.

The plugin contains a Server-Side Request Forgery (SSRF) flaw, identified as CWE-918, which allows an unauthenticated attacker to manipulate server-side requests through the application.

Successful exploitation of this SSRF vulnerability can lead to unauthorized access to internal network resources, potentially exposing sensitive data or allowing an attacker to interact with services restricted to the internal network. With a CVSS score of 8.2, this high-severity flaw poses a significant risk to organizational confidentiality and integrity.

Immediate Action: Update the Newsletters WordPress plugin to version 4.16 or later immediately.

Proactive Monitoring: Monitor server access logs and outbound network traffic for suspicious requests originating from the web server.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious external requests that may indicate SSRF probing.

Public Exploit Available: Unknown

Given the high CVSS score and the existence of a proof-of-concept, organizations must prioritize patching this vulnerability. Administrators should apply the update to version 4.16 without delay to prevent potential unauthorized access to internal network resources.