# CVE-2026-12757: Email Subscribers & Newsletters arbitrary shortcode execution

Source: https://junglewise.ai/threats/cve-2026-12757-email-subscribers-newsletters-arbitrary-shortcode-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-12757 · Severity: medium · CVSS 6.5 · Published 2026-09-07

The Email Subscribers & Newsletters plugin for WordPress allows unauthenticated users to execute arbitrary shortcodes on websites using the plugin. A shortcode is a WordPress feature that extends site functionality; by executing attacker-controlled shortcodes, an attacker could modify page content, exfiltrate data, or perform actions on behalf of the site. This affects all sites running the plugin up to version 5.9.27.

## Quick answers

**Is CVE-2026-12757 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12757 being exploited in the wild.

**How severe is CVE-2026-12757?** Medium severity, with a CVSS score of 6.5, published 7 September 2026.

**Which products and versions are affected?** Email Subscribers Email Subscribers & Newsletters up to and including 5.9.27.

**Is there a fix for CVE-2026-12757?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12757 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12757?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an arbitrary shortcode execution flaw stemming from improper input validation before calling WordPress's do_shortcode() function. An unauthenticated attacker can exploit this by sending a specially crafted request to trigger the vulnerable action without proper sanitization or validation of the shortcode input. The attack vector is network-based and requires no authentication or user interaction. Successful exploitation permits arbitrary shortcode execution, which can lead to data disclosure, site defacement, or privilege escalation depending on available shortcodes. Patches are available in versions after 5.9.27.

## Affected products

- Email Subscribers Email Subscribers & Newsletters up to and including 5.9.27

## Timeline

- 2026-09-07: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.22/lite/includes/classes/class-es-handle-subscription.php](https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.22/lite/includes/classes/class-es-handle-subscription.php)
- [https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.22/lite/includes/classes/class-es-handle-subscription.php](https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.22/lite/includes/classes/class-es-handle-subscription.php)