EUVD-2026-85031
GHSA-52g9-h9fh-xgf2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain target subscriber email address
-
ExploitSend crafted status-change request omitting valid management token
-
ExecutionPlugin skips per-subscriber token verification
-
ImpactSubscription status force-changed for arbitrary subscriber
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication, user interaction, or special configuration required - remote unauthenticated exploitation works against default installations of the Email Subscribers & Newsletters WordPress plugin before 5.9.35. The only practical prerequisite is that the attacker must KNOW the target subscriber's email address, since the status-change is keyed to that address; the vulnerability is that the plugin does not verify the per-subscriber management token that should authorize the change. Limiting factor: impact is restricted to toggling subscription status (unsubscribe/confirm) of known addresses - no data disclosure, code execution, or site takeover is possible. |
| Impact | This is a genuine but low-to-moderate priority issue, not a high-severity one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3 MEDIUM) is internally consistent with the description: a missing-authorization flaw (CWE-862) reachable remotely by unauthenticated attackers with no user interaction, but with integrity-only impact (I:L) and no confidentiality or availability impact. The attacker cannot read subscriber data or take down the site - they can only flip an arbitrary known email's subscription status (force-unsubscribe or force-confirm). No EPSS score, KEV listing, or public POC is present in the input, so there is no evidence of active exploitation or automated weaponization; this reads as a data-integrity/nuisance and anti-spam-abuse concern (e.g., mass force-confirm to fake consent, or mass force-unsubscribe to disrupt a mailing list). The one caveat requiring judgment: exploitation requires knowing the target's email address, which slightly raises practical difficulty against a specific victim but not against bulk/enumerated lists - the CVSS AC:L reasonably reflects that no technical complexity is involved once an email is known. |
| Exploit ScenarioDerived | An unauthenticated attacker who knows or has harvested subscriber email addresses sends crafted requests to the plugin's subscription-status endpoint without supplying the valid per-subscriber management token, which the plugin fails to verify. They can then force-unsubscribe recipients to disrupt a site's newsletter, or force-confirm addresses to fabricate opt-in consent. No public exploit code is identified in the provided data, but the flaw is trivially scriptable against a known email list. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Missing authorization in the WordPress plugin Email Subscribers & Newsletters (versions before 5.9.35) lets unauthenticated remote attackers force-unsubscribe or force-confirm an arbitrary subscriber simply by supplying that subscriber's email address, because the plugin never validates the per-subscriber management token that should gate the subscription-status change. Exploitation requires no authentication, no user interaction, and no special configuration - only knowledge of a target email address on the mailing list. Impact is confined to integrity manipulation of subscription state (silent removal or confirmation of subscribers), with no data disclosure, code execution, or site takeover; only a single reference (WPScan advisory) is available, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
RemediationAI
The primary fix is to upgrade the Email Subscribers & Newsletters plugin to version 5.9.35 or later - the first release that restores validation of the per-subscriber management token; vendor-released patch: 5.9.35, as reflected in the 'before 5.9.35' affected range and the vendor patch availability noted in the source data. Plugin updates on WordPress are typically applied through the admin dashboard under Plugins → Installed Plugins, or via WP-CLI (wp plugin update email-subscribers), and sites using managed hosting or auto-updates should confirm the version actually landed. Where immediate upgrade is not possible, specific compensating controls include temporarily deactivating the plugin (guaranteed fix, but disables all subscription, newsletter, and mailing-list functionality and hides opt-in forms), or restricting external access to the plugin's subscription-status/confirmation endpoints at the WAF, reverse proxy, or web-server level so that only trusted networks or the legitimate confirmation flow can reach them (partial mitigation; it can break legitimate double opt-in confirmations and unsubscribe links for real subscribers, and crafted requests that bypass the filter remain exploitable). Because exploitation only requires knowing a subscriber's email address, routine email-address hygiene and monitoring subscriber lists for unexplained unsubscribe/confirm churn are useful detective measures but are not preventive; since no public exploit code is known, the risk is more one of quiet subscriber-list manipulation than mass automated attack. Advisory reference: https://wpscan.com/vulnerability/54cb2a98-7860-40dd-817e-1294317084aa/ (and NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-83555).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is a WordPress plugin, Email Subscribers & Newsletters, which manages mailing-list subscribers and exposes endpoints for subscribing, confirming (double opt-in), and unsubscribing via email addresses. The flaw maps to CWE-862 (Missing Authorization): the handler that changes a subscriber's status performs no verification of the per-subscriber management token - the secret that links a status-change request to a specific subscriber record and prevents one party from acting on another's behalf. Functionally the plugin treats knowledge of the email address as sufficient authority, so an attacker who knows or guesses a subscriber address can trigger state transitions (force-unsubscribe or force-confirm) on that record. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction and a low integrity-only impact; the absence of confidentiality and availability impact reflects that only the subscription flag - not subscriber data, credentials, or site content - is altered. CPE-style version data (EUVD: 'Email Subscribers & Newsletters 0 <5.9.35') and the WPScan-sourced advisory confirm the affected range as every release prior to 5.9.35, with no other product or platform involved.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated remote request with no interaction (AV:N/AC:L/PR:N/UI:N); integrity-only impact limited to flipping subscription status (I:L), no confidentiality or availability effect.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB