Description

The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-23T06:17:00.963Z",
  "pubdate": "2026-09-23T06:17:00.963Z",
  "executiveSummary": "The Newsletters WordPress plugin versions prior to 4.18.1 suffer from a critical Insecure Direct Object Reference (IDOR) and broken access control vulnerability. The flaw resides in the subscriber management module, which fails to implement robust ownership validation for administrative actions.\nThis vulnerability allows unauthenticated attackers to manipulate subscriber records and access sensitive personal data. By requesting a management session, unauthorized actors can bypass authentication protocols, gain elevated access to the subscriber database, and overwrite existing records, including email addresses.\nThe impact is significant, as it facilitates unauthorized data exfiltration and potential account takeover or phishing campaigns targeting legitimate users. The vulnerability is exploitable remotely over the network without requiring any prior authentication, making it a high-risk security flaw for any WordPress installation utilizing the affected plugin version. Administrators should treat this as a high-priority security concern and ensure that systems are updated immediately to remediate the broken access control mechanisms.",
  "technicalDetails": "The root cause of this vulnerability is an authentication bypass and missing authorization check within the subscriber management functionality of the Newsletters plugin. The application logic fails to verify the identity or ownership permissions of the user initiating requests to management endpoints. Consequently, the plugin issues management sessions to unauthenticated visitors upon request, essentially granting them the privileges of an authorized subscriber or administrator within the context of the subscriber management module.\nThe attack flow begins when an unauthenticated attacker sends a request to the plugin's endpoint responsible for session generation. Because the plugin does not enforce authentication, it returns a valid management session token to the attacker. With this session established, the attacker gains the ability to interface with backend functions that are intended only for authorized management tasks. The attacker can then supply specific identifiers (e.g., subscriber IDs) to these functions, allowing for the retrieval of PII (Personally Identifiable Information) associated with any subscriber currently stored in the database.\nBeyond unauthorized read access, the vulnerability permits write access through the same broken authorization framework. The attacker can craft malicious requests to modify existing subscriber records. By altering the email address field in the database, an attacker can effectively hijack a user's subscription record. This modification could be leveraged for further social engineering or to redirect communication and authentication recovery processes controlled by the attacker.\nThe vulnerability affects all versions of the Newsletters plugin prior to 4.18.1. Because the defect exists at the architectural level of the plugin’s request handling and session management logic, it is accessible via any web interface where the plugin is active, provided the target endpoint is reachable. No specific elevated privileges are required for the initial trigger of the management session, and the exploitation is entirely remote. The post-exploitation impact includes the systematic compromise of user data integrity and the potential for large-scale administrative manipulation of the mailing list records stored by the plugin."
}