Newsletters 4.18 Release Notes

Release notes for version 4.18 of the WordPress Newsletter plugin.

This is a small update. We are preparing a larger v5.0 update with new features, templates, and improvements. Coming soon!

Improved

• Prevent newsletter processing and metadata changes during WordPress autosaves.

Fixed

• Fixed subscriber management access control bypass in unsubscribe links by requiring a non-empty matching authkey with a strict comparison, rejecting empty stored authkeys, and preventing unauthenticated unsubscribe requests from issuing persistent management cookies. Reported by Yaswanth Reddy Sunkara.
• Hardened manage-subscriptions login, resubscribe, delete, and user unsubscribe actions so request-supplied subscriber or user details cannot be used without a valid management token or existing authenticated session.
• Add capability check and nonce verification to the “Send as Newsletter” post save handler (credit Wordfence)
• Add role whitelist validation for user roles selected during post save.
• Resubscribe templates now show success messages and management links only after a successful resubscribe.