Description

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-23T06:17:02.483Z",
  "pubdate": "2026-09-23T06:17:02.483Z",
  "executiveSummary": "The Email Subscribers & Newsletters WordPress plugin contains a critical broken access control vulnerability affecting all versions prior to 5.9.35.\nThis flaw allows unauthenticated attackers to perform unauthorized administrative actions on subscriber records by manipulating subscription status.\nThe vulnerability stems from the application's failure to validate the cryptographic management token associated with a specific subscriber profile when processing status update requests.\nBy knowing a target's email address, an attacker can force a subscriber to be unsubscribed from, or confirmed for, mailing lists without the victim's interaction or authorization.\nThe impact includes potential loss of communication, suppression of marketing activities, or unauthorized enrollment in newsletters, leading to reputational damage and compromised data integrity within the subscriber database.\nThis vulnerability is particularly severe because it requires no authentication or special privileges, making it accessible to any remote attacker with network access to the target WordPress instance.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of access control mechanisms within the subscription management functions of the Email Subscribers & Newsletters plugin. Specifically, the plugin logic fails to verify the integrity and ownership of the per-subscriber management token during status modification requests.\nIn a secure implementation, actions such as unsubscribing or confirming a subscription should require a unique, secret token provided in the URL or request parameters to verify that the request originated from the legitimate subscriber. The affected plugin versions perform these state transitions based primarily on the email address identifier without requiring validation of the corresponding security token.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies a target subscriber's email address associated with the WordPress site. The attacker then constructs a crafted HTTP request (typically a GET or POST request targeting the plugin's subscription management endpoint) using the target's email address as an identifier. Because the backend application logic relies solely on the presence of the email address rather than validating the cryptographic management token, the server processes the request as legitimate.\nUpon execution, the plugin's internal functions update the database entry for the specified email address, effectively modifying the 'status' flag of the subscriber record. This allows the attacker to force a subscriber to either opt-out of the mailing list or inadvertently opt-in if the endpoint supports confirmation states.\nThis vulnerability exists in the core subscription handling logic of the plugin. As the status change is performed server-side without an authentication check or token verification, the attack requires minimal effort and is not restricted by standard WordPress permission levels. The lack of rate limiting on these endpoints further exacerbates the potential for mass subscription manipulation, as an attacker can automate requests for a list of known subscriber email addresses.\nPost-exploitation, the impact is significant: attackers can conduct targeted denial-of-service on communication channels by unsubscribing users en masse, or potentially perform unauthorized subscription to campaigns, which may be leveraged for social engineering or spam-related abuse of the mailing platform."
}