CVE-2026-11592
Received Received - Intake

Authorization Bypass in Email Subscribers & Newsletters WordPress Plugin

Publication date: 2026-07-02

Last updated on: 2026-07-02

Assigner: Wordfence

Description
The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to overwrite plugin mail settings (from name and from email address), create audience lists, insert arbitrary contacts into those lists, create and overwrite newsletter broadcasts and post notifications, add workflows, and queue and dispatch mass email to arbitrary recipients.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-02
Last Modified
2026-07-02
Generated
2026-07-02
AI Q&A
2026-07-02
EPSS Evaluated
N/A
NVD
CVE-2026-11592
EUVD
EUVD-2026-41248

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mailpoet email_subscribers_and_newsletters to 5.9.27 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability exists in the Email Subscribers & Newsletters plugin for WordPress, up to and including version 5.9.27. It is an authorization bypass issue where the plugin fails to properly verify if a user is authorized to perform certain actions.

This flaw allows authenticated users with contributor-level access or higher to perform unauthorized actions such as overwriting plugin mail settings (including the 'from' name and email address), creating audience lists, inserting arbitrary contacts, creating and overwriting newsletter broadcasts and post notifications, adding workflows, and queuing and sending mass emails to arbitrary recipients.

Impact Analysis

This vulnerability can lead to unauthorized modification of email marketing settings and content within the plugin. An attacker with contributor-level access could send mass emails to arbitrary recipients, potentially leading to spam, phishing campaigns, or reputational damage.

Additionally, the attacker could manipulate audience lists and newsletter broadcasts, which could disrupt legitimate communications and compromise the integrity of email marketing efforts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11592. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart