CVE-2026-83555 in Email Subscribers & Newsletters Plugin
Summary
by MITRE • 09/23/2026
The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Email Subscribers & Newsletters versions prior to 5.9.35 represents a critical authentication bypass within the plugin’s user management subsystem. This flaw stems from a fundamental failure to validate session-based or request-specific tokens when processing administrative actions related to subscriber status changes. Specifically, the application logic relies on the presence of an email address as sufficient proof of authority for modifying subscription states, ignoring the requirement for a unique, cryptographically secure per-subscriber token that is typically generated during account creation or confirmation processes. This design oversight allows any external actor with knowledge of a target’s email address to interact directly with the plugin’s API endpoints without providing valid credentials or session cookies.
From a technical perspective, this constitutes an Insecure Direct Object Reference (IDOR) combined with Broken Access Control mechanisms. The application fails to enforce proper authorization checks on state-changing operations. When a request is made to update a subscriber's status, such as moving them from subscribed to unsubscribed or vice versa, the server processes the action based solely on the provided email identifier. It does not verify that the requester possesses the corresponding management token which serves as proof of legitimate ownership or administrative privilege for that specific record. This lack of validation means that the integrity of the subscriber database is compromised by external inputs that are not sufficiently sanitized or authenticated against expected security contexts.
The operational impact of this vulnerability allows unauthenticated attackers to perform force-unsubscribe and force-confirm actions on arbitrary users. Force-unsubscribing can lead to denial-of-service conditions for marketing campaigns, causing significant loss of engagement metrics and potentially violating anti-spam regulations such as CAN-SPAM or GDPR by removing user consent without their explicit action. Conversely, the ability to force-confirm subscribers enables attackers to inject unwanted recipients into mailing lists, which can damage sender reputation scores with email service providers due to increased spam complaints from users who did not opt-in voluntarily. This manipulation undermines trust in the communication channel and exposes organizations to compliance risks associated with unauthorized data processing.
This vulnerability aligns closely with CWE-284, Improper Access Control, as it involves a failure to restrict access to resources based on user identity or privileges. Furthermore, within the MITRE ATT&CK framework, this behavior maps to T1530, Data from Cloud Storage Object Exposed via API, if viewed through the lens of unauthorized data manipulation, and more accurately to T1498, Network Denial of Service, when used for force-unsubscribing campaigns. It also reflects aspects of CWE-602, Client-Side Enforcement of Server-Side Access Control, where the security logic is either missing or improperly implemented on the server side, relying instead on assumptions that are easily bypassed by direct API interaction.
Mitigation strategies must prioritize immediate patching to version 5.9.35 or later, which addresses this flaw by implementing strict token verification for all subscriber management endpoints. In addition to updating software, administrators should ensure that their WordPress installations utilize strong authentication mechanisms and consider deploying Web Application Firewalls (WAFs) capable of detecting anomalous patterns in API requests targeting subscription tables. Regular security audits focusing on input validation and authorization checks are essential to prevent similar IDOR vulnerabilities across other plugins or custom code within the ecosystem.