CVE-2026-83555
Email Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription Status Change via Missing Token Verification
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know.
| Vendor | unknown |
| Product | email subscribers & newsletters |
| Published | Sep 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown email subscribers & newsletters
Be the first to know when new unknown vulnerabilities affecting unknown email subscribers & newsletters are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Email Subscribers & Newsletters
0 < 5.9.35
References
Credits
Usama Arshad WPScan