EUVD-2026-85021
GHSA-q3j5-fxpp-r5pf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach plugin endpoint over network
-
DeliveryRequest management session as anonymous visitor
-
ExploitBypass missing ownership check
-
ExecutionEnumerate subscriber records
-
ImpactRead PII and overwrite email addresses
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitable against any site running the Newsletters WordPress plugin at a version before 4.18.1 with its subscriber-management functionality reachable - no authentication, user interaction, or non-default configuration is required, because the plugin itself issues a management session to unauthenticated visitors and omits the per-record ownership check. The only real limiting factors are that the target must have this specific plugin installed and unpatched, and impact is bounded to the plugin's subscriber dataset (PII disclosure and record/email overwrite) rather than full WordPress compromise. |
| Impact | This is a genuine but moderate-priority issue. The CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) correctly reflects a remotely reachable, unauthenticated, low-complexity flaw with no user interaction - the description confirms the plugin actively issues a management session to any unauthenticated visitor and skips ownership checks, so PR:N is well-supported rather than inferred. SSVC aligns: Exploitation=none (no observed in-the-wild activity), Automatable=yes (subscriber records can be enumerated and mass-scraped/overwritten via scripted requests), Technical Impact=partial (limited to subscriber PII confidentiality and record integrity, not full site compromise). No EPSS score is provided and the CVE is not in CISA KEV, so there is no signal of active exploitation - this is a real-risk-but-not-emergency item. The C:L/I:L rating is arguably conservative given that overwriting any subscriber's email address could support phishing pivots or list hijacking; a case for I:H exists, but NVD's I:L is defensible since impact is confined to the newsletter subscriber dataset. The single reference is a WPScan advisory writeup, which is disclosure documentation, not weaponized exploit code, so POC availability should not be treated as confirmed. |
| Exploit ScenarioDerived | An unauthenticated attacker requests a subscriber-management session from the plugin's endpoint, which the plugin grants without any login. Using that session and predictable subscriber identifiers, they enumerate and read every subscriber's personal data and overwrite arbitrary subscriber records - including changing email addresses to attacker-controlled ones. No public exploit code was identified at time of analysis, but the flaw is automatable and requires no authentication or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated attackers can read and overwrite any subscriber's personal data - including changing their email address - on WordPress sites running the Newsletters plugin at any version before 4.18.1. Because the plugin hands out a management session to unauthenticated visitors on request and then omits an ownership check on several subscriber-management actions, no credentials, user interaction, or non-default configuration are needed; the attacker simply requests a session and then references another subscriber's record directly. The impact is bounded to the plugin's subscriber dataset (PII disclosure plus record/email tampering) rather than full WordPress takeover, and this is a moderate-priority issue: no public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none while marking the flaw automatable, so mass scanning should be expected even without a published PoC. A vendor patch is available in 4.18.1; EPSS data was not provided in the source set.
RemediationAI
Upgrade the Newsletters plugin to 4.18.1 or later - this is the only complete fix, and the vendor has released it (patch status: vendor-released patch, version 4.18.1), with details in the WPScan advisory at https://wpscan.com/vulnerability/0dd1de2d-e9bb-4c42-a78b-2643d43dfed6/. If immediate patching is not possible, deactivate and remove the plugin entirely; because the vulnerable behavior is the plugin's own subscriber API rather than a separable feature flag, there is no configuration toggle that reliably closes the ownership-check gap, and removing the plugin will naturally take its subscription forms and subscriber-management UI offline - plan for that functional loss and export subscriber data first if it is needed for migration. Blocking or rate-limiting unauthenticated POST requests to the plugin's subscriber/management endpoints at the WAF or reverse proxy is a partial compensating control: it removes the easy anonymous session acquisition path and throttles key enumeration, but it is bypassable if the endpoint paths change between minor versions and it does not fix the missing ownership check, so it should be treated as a stopgap only. Where the plugin must stay live briefly, consider restricting the affected endpoints to trusted source IP ranges (for example an administrative VLAN) - effective but it breaks legitimate public subscription traffic from real visitors. Finally, treat any site that ran a pre-4.18.1 version as potentially compromised: audit subscriber records for unexpected email changes or injected entries, review WordPress access and mail logs for anomalous subscriber-management calls, and notify affected subscribers if PII disclosure is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-639, Authorization Bypass Through User-Controlled Key - commonly called IDOR. The Newsletters plugin exposes subscriber-management endpoints whose object references (subscriber identifiers) are supplied by the client, and the code path that handles them never verifies that the caller owns the record being acted upon. Compounding this, the plugin issues some form of management session token to unauthenticated visitors on request, so an anonymous requester can obtain a session that the plugin treats as sufficient to reach those management actions. The result is a horizontally privileged operation without authentication: an attacker enumerates or guesses subscriber keys and can both read the associated personal data and overwrite records, including the email address field, which additionally enables subscriber-account takeover or mail redirection depending on downstream flows. The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N confirms the network-reachable, unauthenticated, no-interaction nature of the issue and the partial confidentiality and integrity impact confined to a single security scope - there is no availability impact and no scope change, so a compromised subscriber dataset does not by itself imply WordPress administrator or host compromise. The affected component is a third-party WordPress plugin rather than WordPress core, so exposure depends entirely on whether the plugin is installed and left unpatched.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated network exploitation with no interaction (PR:N/UI:N/AC:L) since the plugin grants a session to anyone; impact limited to subscriber PII read (C:L) and record/email overwrite (I:L), no availability effect.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB