Newsletter <= 9.3.9 - Unauthenticated Missing Authorization to Subscriber Data Overwrite via Re-Subscription
- ID
- WPSEC-2026-0227
- Plugin
- Newsletter – Send awesome emails from WordPress (newsletter)
- Affected
- all versions before 9.4.0
- Remediation
- Update to 9.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- Newsletter on WPSec AttackSurface
- Fix released
- Published
Description
The Newsletter plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 9.3.9 due to a missing ownership check in NewsletterSubscription::subscribe2() when an email address that already belongs to a confirmed subscriber is submitted through the public subscription form. When repeated subscriptions are handled with single opt-in, which is the default configuration, the submitted data was merged directly into the existing subscriber record without any confirmation from the address owner. This makes it possible for unauthenticated attackers who know a subscriber's email address to overwrite that subscriber's name, gender, language, public profile fields and tracking preference, and to add them to public lists.
References
- https://wpsec.com/vuln/WPSEC-2026-0227/
- https://plugins.svn.wordpress.org/newsletter/tags/9.4.0/
- https://wordpress.org/plugins/newsletter/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS