CVE-2026-83555
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Email Subscribers & Newsletters plugin for WordPress before version 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know.
Risk Assessment
Attackers can manipulate subscription statuses of other users, potentially disrupting communications and eroding trust.
Recommendation
Update the Email Subscribers & Newsletters plugin to version 5.9.35 or later, which includes the token verification fix.
Other vulnerabilities in Email Subscribers & Newsletters
See all- CVE-2026-12757Medium
The Email Subscribers & Newsletters plugin for WordPress up to version 5.9.27 is vulnerable to arbitrary shortcode execution. This is due to improper validation before running do_shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes.
- CVE-2026-81290High
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters versions up to 5.9.33.
- CVE-2026-11592Medium
The Email Subscribers & Newsletters plugin for WordPress up to version 5.9.27 is vulnerable to authorization bypass. Authenticated attackers with contributor-level access or higher can overwrite mail settings, create audience lists, insert contacts, create and overwrite newsletters, add workflows, and send mass emails to arbitrary recipients.
Original NVD description (English source)
The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS