Ecomail <= 2.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Email Newsletter Subscription Changes via 'ecmid' Parameter
- ID
- WPSEC-2026-0161
- Plugin
- Ecomail (ecomail)
- Affected
- from 2.4.0 before 2.5.0
- Remediation
- Update to 2.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Not seen · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Ecomail on WPSec AttackSurface
- Fix released
- Published
Description
The Ecomail plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.4.0 to 2.4.3 due to the My Account newsletter subscription toggle acting on the email address stored in the 'ecm_email' cookie, which any visitor can set to an arbitrary value through the 'ecmid' query parameter, instead of the logged-in user's own email address. This makes it possible for authenticated attackers, with Subscriber-level access and above, to unsubscribe arbitrary email addresses from the store's Ecomail list, or to subscribe arbitrary email addresses to it with double opt-in confirmation skipped and resubscription forced.
References
- https://wpsec.com/vuln/WPSEC-2026-0161/
- https://plugins.svn.wordpress.org/ecomail/tags/2.5.0/
- https://wordpress.org/plugins/ecomail/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS