Newsletter <= 9.4.3 - Unauthenticated Open Redirect via 'redirect' Parameter
- ID
- WPSEC-2026-0238
- Plugin
- Newsletter – Send awesome emails from WordPress (newsletter)
- Affected
- all versions before 9.4.4
- Remediation
- Update to 9.4.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
- Weakness
- CWE-601
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- Newsletter on WPSec AttackSurface
- Fix released
- Published
Description
The Newsletter plugin for WordPress is vulnerable to Open Redirect via the 'redirect' parameter of the 'profile-change' action in all versions up to, and including, 9.4.3 due to insufficient validation of the redirect URL. Versions before 8.3.9 did not validate it at all, and later versions only checked that it began with the site's home URL, which a host such as example.com.evil.com passes. This makes it possible for unauthenticated attackers who hold a valid key for a confirmed subscriber, such as one they registered themselves, and who name a public list in the link, to craft links on the trusted site that redirect users to malicious external sites if they can trick a user into clicking them. In versions 9.4.0 to 9.4.3 the key must be one issued for this action or a pre-9.4.0 key used during the one-month transition after the upgrade, which limits exposure on those versions.
References
- https://wpsec.com/vuln/WPSEC-2026-0238/
- https://plugins.svn.wordpress.org/newsletter/tags/9.4.4/
- https://wordpress.org/plugins/newsletter/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS