CVE-2026-16264
MediumCVSS 6.5Summary
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request. This allows attackers to read any subscriber's personal data and overwrite any subscriber's record, including their email address.
Risk Assessment
An unauthenticated attacker can access subscribers' personal data and modify their records, breaching confidentiality and integrity and potentially hijacking email communication.
Recommendation
Update the Newsletters plugin to version 4.18.1 or later. Until then, consider disabling the plugin or restricting access to its subscriber management features.
Other vulnerabilities in Newsletters WordPress plugin
See all- CVE-2026-16268High
The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side. This allows unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.
- CVE-2026-12583High
The Newsletters WordPress plugin before version 4.15 fails to prevent deserialization of untrusted input submitted via a public form. This allows unauthenticated attackers to inject a PHP object and, through a property-oriented gadget chain, write arbitrary files and execute code on the server.
Original NVD description (English source)
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address.