Newsletter <= 9.3.9 - Unauthenticated Authentication Bypass via Predictable Subscriber Token
- ID
- WPSEC-2026-0225
- Plugin
- Newsletter – Send awesome emails from WordPress (newsletter)
- Affected
- all versions before 9.4.0
- Remediation
- Update to 9.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-338
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- Newsletter on WPSec AttackSurface
- Fix released
- Published
Description
The Newsletter plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 9.3.9 due to subscriber tokens being generated with a non-cryptographic random number generator (the first 10 characters of md5(rand()), at most 2^31 possible values) and then used, without any expiry, as the only secret in subscriber action links and the subscriber cookie. This makes it possible for unauthenticated attackers who can predict or recover a subscriber's token, for example by reconstructing the generator state from tokens issued to their own subscriptions, to act as that subscriber indefinitely, viewing and modifying their profile data, exporting their stored information and changing their subscription status.
References
- https://wpsec.com/vuln/WPSEC-2026-0225/
- https://plugins.svn.wordpress.org/newsletter/tags/9.4.0/
- https://wordpress.org/plugins/newsletter/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS