Insecure Direct Object References in Email Marketing Tool by Omnisend
CVE-2026-97074

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Newsletters, Email Marketing, Sms And Popups By Omnisend
Vendor
CVE Published:
30 September 2026

What is CVE-2026-97074?

A vulnerability exists in the Omnisend platform for versions 1.9.0 and earlier, where Subscriber Insecure Direct Object References (IDOR) can allow unauthorized users to access sensitive information related to newsletters, email campaigns, SMS communications, and popups. This security flaw may enable attackers to manipulate requests to retrieve data that they should not have permission to access, thereby posing a serious risk to user privacy and data integrity.

Affected Version(s)

Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0

References

https://patchstack.com/database/wordpress/plugin/omnisend...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Elaprendiz1927 | Patchstack Bug Bounty Program
.