Vulnerabilities / Newsletter / WPSEC-2026-0226
Newsletter <= 9.3.9 - Cross-Site Request Forgery to Subscriber Profile Update
Medium 4.3
CWE-352Fixed in 9.4.0
- ID
- WPSEC-2026-0226
- Plugin
- Newsletter – Send awesome emails from WordPress (newsletter)
- Affected
- all versions before 9.4.0
- Remediation
- Update to 9.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- Newsletter on WPSec AttackSurface
- Fix released
- Published
Description
The Newsletter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.3.9 due to missing nonce validation on the profile save ('ps') action, which identified the subscriber from the plugin's 'newsletter' cookie. This makes it possible for unauthenticated attackers to change a subscriber's profile data, including their list subscriptions and, when double opt-in is disabled (the default), their email address, via a forged request granted they can trick a subscriber whose browser holds the subscriber cookie into performing an action such as clicking a link.
References
- https://wpsec.com/vuln/WPSEC-2026-0226/
- https://plugins.svn.wordpress.org/newsletter/tags/9.4.0/
- https://wordpress.org/plugins/newsletter/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS