MailPoet – Newsletters, Email Marketing, and Automation <= 5.41.0 - Unauthenticated Open Redirect via Tracked Link Shortcodes and Personalization Tags
- ID
- WPSEC-2026-0951
- Plugin
- MailPoet – Newsletters, Email Marketing, and Automation (mailpoet)
- Affected
- all versions before 5.42.0
- Remediation
- Update to 5.42.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-601
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- MailPoet – Newsletters, Email Marketing, and Automation on WPSec AttackSurface
- Fix released
- Published
Description
The MailPoet plugin for WordPress is vulnerable to Open Redirect via the click tracking endpoint in all versions up to, and including, 5.41.0. The cause is that tracked link URLs whose destination is set by shortcode values, such as subscriber fields, or by personalization tag tokens were redirected to without validating the destination host. This makes it possible for unauthenticated attackers who subscribe with crafted field values to obtain tracked links on the site that redirect to arbitrary external hosts. Exploitation requires a newsletter link whose destination is built from such subscriber data or tags, and a victim must click the link.
References
- https://wpsec.com/vuln/WPSEC-2026-0951/
- https://plugins.svn.wordpress.org/mailpoet/tags/5.42.0/
- https://wordpress.org/plugins/mailpoet/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS