CVE-2026-16264

The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address.

Score

CVSS 3.1 6.5 Medium

Status

Deferred - contact@wpscan.com

Published

2026-09-23

Last modified

2026-09-23

Weaknesses

CWE-639

Affected products

• Newsletters (Unknown)

References

• https://wpscan.com/vulnerability/0dd1de2d-e9bb-4c42-a78b-2643d43dfed6/