{
 "id": "WPSEC-2026-0951",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0951/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0951/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0951/index.md",
 "title": "MailPoet – Newsletters, Email Marketing, and Automation <= 5.41.0 - Unauthenticated Open Redirect via Tracked Link Shortcodes and Personalization Tags",
 "description": "The MailPoet plugin for WordPress is vulnerable to Open Redirect via the click tracking endpoint in all versions up to, and including, 5.41.0. The cause is that tracked link URLs whose destination is set by shortcode values, such as subscriber fields, or by personalization tag tokens were redirected to without validating the destination host. This makes it possible for unauthenticated attackers who subscribe with crafted field values to obtain tracked links on the site that redirect to arbitrary external hosts. Exploitation requires a newsletter link whose destination is built from such subscriber data or tags, and a victim must click the link.",
 "plugin": {
  "slug": "mailpoet",
  "name": "MailPoet – Newsletters, Email Marketing, and Automation",
  "full_name": "MailPoet – Newsletters, Email Marketing, and Automation",
  "wordpress_org": "https://wordpress.org/plugins/mailpoet/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mailpoet/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mailpoet"
 },
 "type": "REDIRECT",
 "cwe": [
  "CWE-601"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.42.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.42.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.42.0",
 "remediation": "Update to 5.42.0 or later.",
 "fix_released": "2026-10-13T14:24:47+00:00",
 "published": "2026-10-14T14:57:06+00:00",
 "updated": "2026-10-14T12:18:11.887584+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0951/",
  "https://plugins.svn.wordpress.org/mailpoet/tags/5.42.0/",
  "https://wordpress.org/plugins/mailpoet/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mailpoet",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-14"
 }
}