Newsletters 4.17 Release Notes

Release notes for version 4.17 of the WordPress Newsletter plugin.

This is a small update. We are preparing a larger v5.0 update with new features, templates, and improvements. Coming soon!

Improved

• Removed PHP null coalescing operators from plugin PHP files for PHP 7.x compatibility.

Fixed

• Fixed predictable API keys by generating random API keys and rotating existing keys on upgrade. Reported by WPScan.
• Fixed CSRF and arbitrary option updates on the API settings page by adding nonce and capability checks and saving only allowed API settings. Reported by WPScan.
• Fixed subscriber management access control bypass in subscription and paid subscription links by requiring the authenticated management subscriber session. Reported by Yaswanth Reddy Sunkara.
• Prevent subscriber management authentication tokens from being written into page output and set manage-subscription link cookies before page rendering.
• Improved the security of subscriber management login tokens.
• Fixed PHP 8+ fatal error in subscription management shortcode when array_merge() received null.