# MailPoet – Newsletters, Email Marketing, and Automation <= 5.41.0 - Unauthenticated Open Redirect via Tracked Link Shortcodes and Personalization Tags

- **ID:** WPSEC-2026-0951
- **Plugin:** MailPoet – Newsletters, Email Marketing, and Automation (`mailpoet`), https://wordpress.org/plugins/mailpoet/
- **Affected versions:** all versions before 5.42.0
- **Fixed in:** 5.42.0 (Update to 5.42.0 or later.)
- **Severity:** Medium 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-601
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mailpoet
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0951/

## Description

The MailPoet plugin for WordPress is vulnerable to Open Redirect via the click tracking endpoint in all versions up to, and including, 5.41.0. The cause is that tracked link URLs whose destination is set by shortcode values, such as subscriber fields, or by personalization tag tokens were redirected to without validating the destination host. This makes it possible for unauthenticated attackers who subscribe with crafted field values to obtain tracked links on the site that redirect to arbitrary external hosts. Exploitation requires a newsletter link whose destination is built from such subscriber data or tags, and a victim must click the link.

## References

- https://wpsec.com/vuln/WPSEC-2026-0951/
- https://plugins.svn.wordpress.org/mailpoet/tags/5.42.0/
- https://wordpress.org/plugins/mailpoet/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0951/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.