Description

The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-07T14:16:51.053Z",
  "pubdate": "2026-09-07T14:16:51.053Z",
  "executiveSummary": "The Email Subscribers & Newsletters plugin for WordPress is susceptible to an arbitrary shortcode execution vulnerability across all versions up to and including 5.9.27.\nThis vulnerability is categorized as an improper input validation flaw, specifically concerning the handling of user-supplied data passed to the do_shortcode function.\nThe security flaw enables unauthenticated attackers to execute arbitrary shortcodes within the WordPress environment without requiring prior authorization or administrative privileges.\nSuccessful exploitation may lead to the unauthorized execution of sensitive shortcode-based functions, potentially resulting in data exfiltration, unauthorized content modification, or escalation of attack vectors depending on the available shortcodes registered within the WordPress installation.\nThe vulnerability poses a significant risk to the integrity and confidentiality of the affected WordPress site, as the attack surface is exposed to any unauthenticated network user.\nImmediate mitigation is required through the update of the plugin to a secured version, as there are no inherent access controls preventing the exploitation of this logic flaw.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient validation of user-supplied input before it is processed by the WordPress do_shortcode function within the Email Subscribers & Newsletters plugin.\nIn the WordPress ecosystem, shortcodes are dynamic placeholders used to trigger pre-defined functions; when the do_shortcode function is executed, it parses the provided string and triggers any associated registered callback functions.\nThe vulnerability manifests when the plugin processes specific user-supplied inputs as parameters without enforcing strict validation or sanitization against an allow-list of safe shortcodes.\nBecause the affected component does not verify the provenance or the structure of the input, an unauthenticated attacker can craft a malicious request containing a crafted shortcode string.\nThe exploitation flow begins with an attacker identifying an endpoint or a parameter handled by the plugin that leads to the vulnerable execution path. By injecting a crafted shortcode, the attacker influences the execution context of the WordPress instance.\nOnce the plugin processes the input, it invokes do_shortcode with the attacker-controlled payload. This causes the WordPress core to execute the arbitrary shortcode, effectively bypassing intended functional restrictions.\nThe impact of this vulnerability is highly dependent on the shortcodes available in the environment; an attacker may leverage this to execute shortcodes provided by other installed plugins or the WordPress core that perform sensitive actions, such as administrative operations, information disclosure, or cross-site scripting (XSS) triggers.\nThe vulnerability is persistent across all versions up to 5.9.27. It requires no specific authentication or elevated privileges, making it accessible to any user capable of reaching the vulnerable plugin interface over the network.\nThe payload behavior involves the successful invocation of arbitrary logic triggered by the WordPress Shortcode API, allowing the attacker to interact with the database or server-side functions that are normally protected by the application logic.\nPost-exploitation impact ranges from minor unauthorized actions to significant compromise of the site's logical security, depending on the breadth of shortcodes installed on the host system."
}