# MailPoet – Newsletters, Email Marketing, and Automation <= 5.44.0 - Unauthenticated Subscriber Impersonation via Forged Tracking Cookie

- **ID:** WPSEC-2026-2469
- **Plugin:** MailPoet – Newsletters, Email Marketing, and Automation (`mailpoet`), https://wordpress.org/plugins/mailpoet/
- **Affected versions:** all versions before 5.45.0
- **Fixed in:** 5.45.0 (Update to 5.45.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-565
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mailpoet
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2469/

## Description

The MailPoet plugin for WordPress is vulnerable to subscriber impersonation via the 'mailpoet_subscriber' tracking cookie in all versions up to, and including, 5.44.0. This is due to the plugin trusting the subscriber ID stored in the cookie without a signature or any other check. This makes it possible for unauthenticated attackers, when cookie tracking is enabled, to be identified as any subscriber by setting the cookie to that subscriber's ID. They can then record page-view activity for any subscriber and schedule or cancel WooCommerce abandoned cart emails to them with cart contents the attacker chooses.

## References

- https://wpsec.com/vuln/WPSEC-2026-2469/
- https://plugins.svn.wordpress.org/mailpoet/tags/5.45.0/
- https://wordpress.org/plugins/mailpoet/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2469/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.