CVE-2026-86824
Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key
CVSS Score
4.8
EPSS Score
0.0%
EPSS Percentile
0th
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.
| Vendor | unknown |
| Product | newsletter |
| Published | Sep 17, 2026 |
| Last Updated | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown newsletter
Be the first to know when new medium vulnerabilities affecting unknown newsletter are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Newsletter
0 < 9.3.8
References
Credits
Karthik Ramakrishnan WPScan