MailPoet – Newsletters, Email Marketing, and Automation <= 5.44.0 - Unauthenticated Sensitive Information Exposure via View in Browser
- ID
- WPSEC-2026-2470
- Plugin
- MailPoet – Newsletters, Email Marketing, and Automation (mailpoet)
- Affected
- all versions before 5.45.0
- Remediation
- Update to 5.45.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- MailPoet – Newsletters, Email Marketing, and Automation on WPSec AttackSurface
- Fix released
- Published
Description
The MailPoet plugin for WordPress is vulnerable to Sensitive Information Exposure via the View in Browser feature in all versions up to, and including, 5.44.0. This is due to the plugin returning the stored rendered body of any sending queue that belongs to the requested newsletter without checking that the viewer is the recipient of that queue or an email manager. Welcome and automation emails store one recipient's rendered body per queue, and that body can hold recipient-specific content such as generated coupon codes and cart or order products. This makes it possible for unauthenticated attackers who have a newsletter's view-in-browser link, for example from a copy they received themselves, to view other recipients' personalized email content by changing the queue ID.
References
- https://wpsec.com/vuln/WPSEC-2026-2470/
- https://plugins.svn.wordpress.org/mailpoet/tags/5.45.0/
- https://wordpress.org/plugins/mailpoet/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS