What is the CVSS score of CVE-2026-86824?

CVE-2026-86824 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-86824?

Yes, a public proof-of-concept exploit is available for CVE-2026-86824. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-86824?

Yes, a patch is available for CVE-2026-86824. Update the affected software to the latest version immediately.

Newsletter Plugin CVE-2026-86824

EUVD-2026-81343 MEDIUM

Inadequate Encryption Strength (CWE-326)

2026-09-17 WPScan

GHSA-w6v2-ggcj-c4hg

WordPress Information Disclosure Newsletter Unknown

4.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

Remote and unauthenticated (AV:N/PR:N/UI:N) but gated by mandatory offline recovery of a low-entropy key (AC:H); impact is per-subscriber read and modify (C:L/I:L), no availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 17, 2026 - 13:41 vuln.today

CVSS changed

Sep 17, 2026 - 13:22 NVD

4.8 (MEDIUM)

Patch available

Sep 17, 2026 - 07:00 EUVD

CVE Published

Sep 17, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 17, 2026 - 06:00 cve.org

MEDIUM 4.8

DescriptionCVE.org

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.

AnalysisAI

Forged email tracking links in the Newsletter WordPress plugin before 9.3.8 let an unauthenticated attacker who first recovers the plugin's weakly generated signing key offline obtain any subscriber's session token and then read or modify that subscriber's stored personal data. The root cause is a signing key generated with insufficient entropy combined with tracking links signed by an unkeyed hash, which makes offline key recovery practical rather than dependent on a leaked secret; publicly available exploit code exists. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the plugin's email tracking feature to be in use so that signed tracking links are generated and observable, and the attacker must first perform an offline recovery of the signing key - feasible only because that key is generated with insufficient entropy and the tracking links are signed with an unkeyed hash (CWE-326). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine but moderate-priority issue rather than a high-urgency emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade the Newsletter WordPress plugin to 9.3.8 or later; this is the vendor-released patch and the only complete fix, since it addresses both the low-entropy key generation and the unkeyed signing scheme. … Detailed patch versions, workarounds, and compensating controls in full report.