Executive brief
The Email Subscribers & Newsletters plugin for WordPress allows unauthenticated users to execute arbitrary shortcodes on websites using the plugin. A shortcode is a WordPress feature that extends site functionality; by executing attacker-controlled shortcodes, an attacker could modify page content, exfiltrate data, or perform actions on behalf of the site. This affects all sites running the plugin up to version 5.9.27.
Technical details
The vulnerability is an arbitrary shortcode execution flaw stemming from improper input validation before calling WordPress's do_shortcode() function. An unauthenticated attacker can exploit this by sending a specially crafted request to trigger the vulnerable action without proper sanitization or validation of the shortcode input. The attack vector is network-based and requires no authentication or user interaction. Successful exploitation permits arbitrary shortcode execution, which can lead to data disclosure, site defacement, or privilege escalation depending on available shortcodes. Patches are available in versions after 5.9.27.
Affected products
- Email Subscribers Email Subscribers & Newsletters up to and including 5.9.27
Timeline
- 2026-09-07: disclosed