EUVD-2026-41248
GHSA-7qrc-923r-c8cr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible requiring contributor credentials (PR:L); integrity limited to plugin-scoped data modification (I:L); no confidentiality or availability impact within the vulnerable system.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Email Subscribers & Newsletters - Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to overwrite plugin mail settings (from name and from email address), create audience lists, insert arbitrary contacts into those lists, create and overwrite newsletter broadcasts and post notifications, add workflows, and queue and dispatch mass email to arbitrary recipients.
AnalysisAI
Authorization bypass in the Email Subscribers & Newsletters WordPress plugin (all versions through 5.9.27) allows contributor-level authenticated users to hijack the site's email infrastructure - overwriting sender identity, creating mailing lists, injecting arbitrary contacts, and dispatching mass email to arbitrary external recipients. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity, network-accessible exploitation requiring only a contributor account, which is commonly available on multi-author WordPress sites. No public exploit code has been identified at time of analysis, but the abuse potential - mass phishing campaigns sent through a trusted domain's authenticated mail relay - materially exceeds what the 4.3 CVSS score implies.
Technical ContextAI
The vulnerability affects the 'Email Subscribers & Newsletters' WordPress plugin, a widely-used email marketing solution managing newsletters, post notifications, contact lists, and automated workflows. CWE-862 (Missing Authorization) identifies the root cause: the plugin performs privileged administrative actions without verifying the requesting user holds sufficient WordPress capabilities. The flaw spans at least five distinct plugin files identified in the trac references: class-email-subscribers-admin.php (admin panel operations, line 216), class-ig-es-onboarding.php (onboarding flows, line 171), class-email-subscribers-activator.php (activation logic, line 66), class-es-newsletters.php (newsletter management, line 717), and class-es-workflow-admin-edit.php (workflow editing, line 74). These touch nearly every core functional area of the plugin, suggesting the authorization gap is systemic rather than isolated to a single endpoint. The affected code is confirmed present in plugin tags 5.9.21 and 5.9.24 per trac references.
RemediationAI
Update the Email Subscribers & Newsletters plugin to the latest version available in the WordPress plugin repository, which should include the fix introduced in trac changeset 3584584. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e70691-4de9-4b12-babf-bebe267a780b for the confirmed patched release version once published. If immediate patching is not possible, disable public user registration to prevent new contributor accounts from being created - note this trade-off prevents new author onboarding. Audit all existing contributor-level accounts for signs of unauthorized email dispatch, modified From settings, or unexpected contact list additions. As a more aggressive compensating control, temporarily deactivating the plugin entirely eliminates the attack surface but disables all email marketing and notification functionality. Do not rely on role-based access controls within the plugin alone, as the vulnerability specifically bypasses those checks.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today