Newsletter Plugin CVE-2026-92537

Exploitation requires the attacker to obtain a valid, signed click-tracking URL (/tnp/l/ with a keyed-MD5 signature) for a specific target subscriber - such URLs are embedded in every external link of every newsletter sent, carry no timestamp, and never expire until the site's relink key rotates. The flaw is present in the default configuration of the Newsletter plugin ≤9.3.9 (the REST route is registered with permission_callback => '__return_true'), so no special plugin setting is needed; the only practical limiter is possession of one leaked signed URL, obtainable via forwarded/shared email, mail-gateway logs, or Referer leakage on the redirect target (which sets no Referrer-Policy). No authentication, nonce, password, or email challenge is required once the URL is observed. Fixed in version 9.4.0.

All exploitation signals point to a genuine but bounded data-privacy/account-manipulation flaw rather than a server-compromise emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3) correctly captures network, unauthenticated, no-interaction access, but the vendor's C:N understates the impact: the description explicitly states the leaked raw cookie lets an attacker export the subscriber's full PII record (?na=px), so a confidentiality impact clearly applies - I assess C:L, raising the realistic base to ~6.4. No EPSS score, KEV entry, or POC was supplied; exploitation status is therefore 'no public exploit identified at time of analysis.' The real gating factor is not technical complexity but the need to OBSERVE a valid signed /tnp/l/ click-tracking URL for the victim - however, the description details many low-effort leak channels (forwarded emails, shared inboxes, mail-gateway logs, and Referer headers on redirect targets that carry no Referrer-Policy), and the URLs never expire until the relink key rotates, which makes opportunistic/replay abuse plausible at scale. Net: a real priority for sites holding sensitive subscriber lists (GDPR-relevant PII exposure plus silent profile rewrite/unsubscribe), but it yields subscriber-scoped credential theft, not site or server takeover.

An attacker obtains a signed newsletter click-tracking URL for a target subscriber - e.g. from a forwarded campaign email, a mail-gateway log, or a Referer header leaked by the redirect target - and replays it against /tnp/l/. The server responds with a Set-Cookie header containing the subscriber's permanent raw authentication token, which the attacker then presents to ?na=px to export the subscriber's full PII, to ?na=ps to rewrite their stored profile, or to ?na=ocu to silently unsubscribe them, none requiring a nonce or password. No public POC was provided, but the attack is deterministic and requires no special tooling.