Description

The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises changes to their record.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-26T06:16:30.007Z",
  "pubdate": "2026-08-26T06:16:30.007Z",
  "executiveSummary": "The Simple Newsletter Plugin for WordPress, in versions prior to 4.3.3, contains an improper access control vulnerability leading to sensitive information disclosure.\nThis vulnerability is categorized as an authorization bypass flaw, enabling unauthenticated remote attackers to retrieve private subscriber information.\nBy manipulating public requests, an attacker can access personally identifiable information (PII) stored within the plugin's database.\nFurthermore, the exposure includes the specific authorization keys required to modify subscriber records, presenting a risk of unauthorized account manipulation or data tampering.\nThe vulnerability requires no authentication or special privileges, making it accessible to any remote user with network access to the affected WordPress instance.\nThe risk implication is high, as it compromises user privacy and integrity, potentially facilitating further malicious activities such as unauthorized data modification or social engineering campaigns against subscribers.",
  "technicalDetails": "The root cause of this vulnerability is an authentication and authorization failure within the request handling logic of the Simple Newsletter Plugin.\nThe plugin processes public requests intended for subscriber interaction but fails to implement a verification mechanism to ensure that the entity requesting subscriber details is authorized to view that specific record.\nIn a standard secure implementation, the application should validate that the requester possesses a valid session, token, or shared secret that maps to the requested record identity before rendering sensitive fields.\nInstead, the plugin assumes that the presence of a request parameter is sufficient to grant access, effectively creating an insecure direct object reference (IDOR) scenario.\nThe attack flow begins when an attacker identifies the endpoint responsible for fetching subscriber data. Because the plugin does not verify the requester's identity against the subscriber record, the attacker can iterate through or guess identifiers to pull subscriber data.\nUpon a successful request, the application backend fetches the stored subscriber details from the database and returns them in the response body. This payload includes PII and the authorization keys associated with the record.\nThese keys are sensitive, as they are typically used by the plugin to provide 'one-click' modification or unsubscription capabilities without requiring full user authentication.\nBy acquiring these keys, an attacker can bypass the legitimate update flow, allowing them to perform administrative-level actions on behalf of the subscriber, such as changing email addresses, modifying subscription preferences, or deleting records.\nThe vulnerability affects all versions of the Simple Newsletter Plugin prior to 4.3.3. It is exposed over the network via standard HTTP/HTTPS requests directed at the plugin's exposed public-facing interfaces.\nThe lack of robust access control checks means the exploit does not require any specialized payloads; simple manipulation of input parameters in a GET or POST request is sufficient to trigger the data exposure."
}