Omnisend WordPress Plugin CVE-2026-97074

Exploitation requires an authenticated WordPress account at Subscriber level or higher on a site running Omnisend Newsletters, Email Marketing, SMS and Popups plugin version 1.9.0 or earlier (PR:L). No user interaction is needed (UI:N) and the request is remote/network-based (AV:N). The limiting factors are the authentication requirement (a valid low-privilege account must exist, which on sites allowing open registration is trivial but on closed sites is a barrier) and the narrow impact ceiling - only integrity of specific objects is affected (I:L), with no confidentiality or availability consequences. The exact affected endpoint/parameter is not disclosed in available data.

The composite signals point to a low-to-moderate real-world priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable, low-complexity flaw but requires authenticated low-privilege access (PR:L, described as Subscriber level) and yields only a limited integrity impact (I:L) with no confidentiality (C:N) or availability (A:N) effect. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The CWE-639 (IDOR) classification is consistent with an authenticated user manipulating an object reference to alter data they should not own. The single Patchstack reference is the only corroborating source and does not name the exact parameter or endpoint. One notable metadata conflict: the description and tags label this an 'Authentication Bypass,' but the vector (PR:L) and CWE-639 make this an authorization/IDOR issue, not authentication bypass - the attacker must already be authenticated. Net: a real but low-severity authenticated integrity issue, not a high-urgency remote-code or data-breach event.

An attacker registers or obtains a low-privilege Subscriber account on a WordPress site running the Omnisend plugin (<=1.9.0), then sends a request to an affected plugin endpoint while substituting an object identifier (ID) that belongs to another user or resource. Because the plugin fails to verify ownership of the referenced object, the attacker modifies data they should not control (integrity impact only). No public PoC was provided, and exploitation requires an authenticated account.