{
 "id": "WPSEC-2026-2469",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2469/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2469/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2469/index.md",
 "title": "MailPoet – Newsletters, Email Marketing, and Automation <= 5.44.0 - Unauthenticated Subscriber Impersonation via Forged Tracking Cookie",
 "description": "The MailPoet plugin for WordPress is vulnerable to subscriber impersonation via the 'mailpoet_subscriber' tracking cookie in all versions up to, and including, 5.44.0. This is due to the plugin trusting the subscriber ID stored in the cookie without a signature or any other check. This makes it possible for unauthenticated attackers, when cookie tracking is enabled, to be identified as any subscriber by setting the cookie to that subscriber's ID. They can then record page-view activity for any subscriber and schedule or cancel WooCommerce abandoned cart emails to them with cart contents the attacker chooses.",
 "plugin": {
  "slug": "mailpoet",
  "name": "MailPoet – Newsletters, Email Marketing, and Automation",
  "full_name": "MailPoet – Newsletters, Email Marketing, and Automation",
  "wordpress_org": "https://wordpress.org/plugins/mailpoet/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mailpoet/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mailpoet"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-565"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.45.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.45.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.45.0",
 "remediation": "Update to 5.45.0 or later.",
 "fix_released": "2026-11-03T12:12:07+00:00",
 "published": "2026-11-04T14:58:24+00:00",
 "updated": "2026-11-04T13:56:57.890109+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2469/",
  "https://plugins.svn.wordpress.org/mailpoet/tags/5.45.0/",
  "https://wordpress.org/plugins/mailpoet/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mailpoet",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}