EUVD-2026-66291
GHSA-32qv-rfg8-hw55
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable with no authentication required; I:L justified because the exposed record-modification key enables direct tampering with subscriber data, not merely disclosure.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises changes to their record.
AnalysisAI
Simple Newsletter Plugin for WordPress (versions 4.0.0 through 4.3.2) fails to verify that a public requester matches the subscriber whose record is being fetched, exposing stored personal data and the authorization key that controls changes to that subscriber's record to any unauthenticated caller. A publicly available proof-of-concept documented by WPScan demonstrates the attack path, though EPSS at 0.18% (7th percentile) suggests exploitation has remained limited in observed telemetry. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special configuration or non-default settings are required - exploitation works against any WordPress installation running Simple Newsletter Plugin 4.0.0 through 4.3.2 with at least one active subscriber record. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) accurately characterizes this as a network-exploitable, zero-prerequisite flaw, and that vector is fully consistent with the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends crafted HTTP requests to the plugin's public subscriber-detail endpoint, varying a subscriber identifier parameter to enumerate records; a public proof-of-concept from WPScan documents the precise request format. Each successful response returns the subscriber's stored personal data and the authorization key for that record, which the attacker can then replay to modify the subscriber's details (e.g., altering email address or subscription preferences) with no credentials required. |
| Remediation | The primary fix is to upgrade the Simple Newsletter Plugin to version 4.3.3 or later, available through the WordPress plugin dashboard or the official WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today