MailPoet – Newsletters, Email Marketing, and Automation <= 5.44.0 - Unauthenticated Subscriber Impersonation via Forged Tracking Cookie
- ID
- WPSEC-2026-2469
- Plugin
- MailPoet – Newsletters, Email Marketing, and Automation (mailpoet)
- Affected
- all versions before 5.45.0
- Remediation
- Update to 5.45.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-565
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- MailPoet – Newsletters, Email Marketing, and Automation on WPSec AttackSurface
- Fix released
- Published
Description
The MailPoet plugin for WordPress is vulnerable to subscriber impersonation via the 'mailpoet_subscriber' tracking cookie in all versions up to, and including, 5.44.0. This is due to the plugin trusting the subscriber ID stored in the cookie without a signature or any other check. This makes it possible for unauthenticated attackers, when cookie tracking is enabled, to be identified as any subscriber by setting the cookie to that subscriber's ID. They can then record page-view activity for any subscriber and schedule or cancel WooCommerce abandoned cart emails to them with cart contents the attacker chooses.
References
- https://wpsec.com/vuln/WPSEC-2026-2469/
- https://plugins.svn.wordpress.org/mailpoet/tags/5.45.0/
- https://wordpress.org/plugins/mailpoet/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS