CVE-2026-16264 — Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR

CVE-2026-16264

Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR PUBLISHED

Description (CNA)

The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address.

Affected (CNA)

Vendor / product	Versions
Unknown / Newsletters	affected 0 before 4.18.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/0dd1de2d-e9bb-4c42-a78b-2643d43dfed6/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.