CVE-2026-97074

Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.

Score

CVSS 3.1 4.3 Medium

Status

Deferred - audit@patchstack.com

Published

2026-09-30

Last modified

2026-09-30

Weaknesses

CWE-639

Affected products

• Email Marketing (Omnisend)
• Newsletters (Omnisend)
• Sms And Popups By Omnisend (Omnisend)

References

• https://patchstack.com/database/wordpress/plugin/omnisend/vulnerability/wordpress-newsletters-email-marketing-sms-and-p…