Executive brief
The Noptin WordPress plugin (used for email newsletter management) before version 4.3.3 fails to verify user identity when displaying subscriber preferences. An attacker can view any subscriber's personal data (name, email, custom fields) and obtain an authorization key by simply providing the victim's email address, then use that key to modify the subscriber's account settings without permission.
Technical details
This is an authentication bypass and sensitive data disclosure vulnerability in the Noptin newsletter plugin's subscriber management interface. The plugin's manage_preferences action does not validate that the requester is the subscriber whose data they are requesting; it only requires knowledge of the target subscriber's email address (which is often publicly available or easily guessable). An unauthenticated attacker can call the noptin_ns=manage_preferences action with a victim's email address to receive an HTML response containing stored PII (first name, last name, email, custom fields), a form nonce, and a subscriber confirmation key. The attacker can then replay these credentials to POST requests and modify the victim's subscription status and stored fields. The vulnerability is exploitable via network-accessible HTTP requests with no authentication or user interaction required. Patched in version 4.3.3.
Affected products
- Noptin Noptin before 4.3.3
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Fixed in version 4.3.3