Executive brief
The Newsletters WordPress plugin before version 4.18.1 fails to verify user ownership when processing subscriber management requests and grants session tokens to unauthenticated visitors. An attacker can exploit this flaw to view any subscriber's personal data, modify subscriber records, and hijack email addresses without authentication.
Technical details
The plugin lacks ownership checks in subscriber management actions and issues management sessions to unauthenticated users (CWE-639: Authorization Header Missing Check / IDOR). An attacker can craft requests to read or overwrite any subscriber record, including email addresses, without authentication. The vulnerability was publicly disclosed on 2026-09-21 with a proof-of-concept embargo until 2026-10-05.
Affected products
- Newsletters Newsletters before 4.18.1
Timeline
- 2026-09-21: disclosed
- 2026-09-23: patched: Version 4.18.1 released