CVE-2026-92537
Received Received - Intake

Insufficiently Protected Credentials in The Newsletter WordPress Plugin

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Wordfence

Description
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route `/tnp/l/` is registered with `permission_callback => '__return_true'` and, upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=<id>-<raw_token>` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant. This makes it possible for unauthenticated attackers who obtain any signed click-tracking URL for a target subscriber to receive that subscriber's permanent raw authentication cookie, which they can then use to export the subscriber's full PII record via the JSON profile-export endpoint (`?na=px`), rewrite the subscriber's stored profile (`?na=ps`), and silently unsubscribe the subscriber via the RFC-8058 one-click endpoint (`?na=ocu`), none of which require a nonce, password, or email challenge. Signed tracking URLs are embedded in every external link of every newsletter delivered to a subscriber, carry no timestamp, and never expire until the site's relink key rotates, meaning that any party who observes such a URL — through a forwarded email, a shared inbox, a mail-gateway log, or Referer headers on the redirect target, which has no Referrer-Policy set — can replay it indefinitely to obtain the victim's credential.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-92537
EUVD
EUVD-2026-90455

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wordfence newsletter to 9.3.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in The Newsletter – Send awesome emails from WordPress plugin allows unauthenticated attackers to obtain a subscriber's permanent raw authentication cookie via a signed click-tracking URL. The plugin's public REST route uses a weak permission check, exposing subscriber cookies that can be used to access or modify subscriber data and unsubscribe them without further authentication.

Detection Guidance

Check WordPress sites for the Newsletter plugin versions up to 9.3.9. Inspect network traffic for unprotected cookie headers in responses from the /tnp/l/ REST route. Look for raw authentication tokens in Set-Cookie headers without MD5 masking.

Impact Analysis

Attackers can steal subscriber credentials, access or modify personal data, and unsubscribe users without consent. This could lead to data breaches, unauthorized account access, and loss of trust in the service or website using the plugin.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and insufficient protection of credentials. It may also breach HIPAA if subscriber data includes protected health information, as it allows unauthorized access and modification of sensitive records.

Mitigation Strategies

Update the Newsletter plugin to the latest version beyond 9.3.9. Disable the public click-tracking REST route /tnp/l/ if not required. Rotate all subscriber authentication tokens and review logs for unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92537. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart