Newsletters <= 4.8.8 - Cross-Site Request Forgery

The Newsletters plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.8. This is due to missing nonce validation on several cases in several functions like admin_groups() and admin_forms(). This makes it possible for unauthenticated attackers to manipulate forms and groups via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.