Insufficiently Protected Credentials in Newsletter Plugin for WordPress

CVE-2026-92537

What is CVE-2026-92537?

The Newsletter Plugin for WordPress is susceptible to a significant security flaw due to insufficiently protected credentials. This vulnerability allows unauthenticated attackers to exploit the public click-tracking REST route /tnp/l/, which is incorrectly configured to accept requests without appropriate permission checks. When an attacker successfully obtains a signed click-tracking URL associated with a subscriber, they can access a permanent raw authentication cookie. This enables the attacker to export sensitive personally identifiable information (PII) from the subscriber's profile, modify stored subscriber data, or unsubscribe users without any authentication dependencies. The vulnerability arises from the usage of a valid keyed-MD5 signature, which is not adequately secured against replay attacks while being embedded in every newsletter link, significantly enhancing the risk of exploitation.

References