CVE-2026-16264

Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR

The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address.

Affected

Newsletters

CVSS v3.1 CNA

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.19% chance of exploitation in the next 30 days, 9th percentile

Published

2026-09-23

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/0dd1de2d-e9bb-4c42-a78b-2643d43dfed6/

References

• CVE Record
• NVD entry