{
 "id": "WPSEC-2026-2470",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2470/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2470/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2470/index.md",
 "title": "MailPoet – Newsletters, Email Marketing, and Automation <= 5.44.0 - Unauthenticated Sensitive Information Exposure via View in Browser",
 "description": "The MailPoet plugin for WordPress is vulnerable to Sensitive Information Exposure via the View in Browser feature in all versions up to, and including, 5.44.0. This is due to the plugin returning the stored rendered body of any sending queue that belongs to the requested newsletter without checking that the viewer is the recipient of that queue or an email manager. Welcome and automation emails store one recipient's rendered body per queue, and that body can hold recipient-specific content such as generated coupon codes and cart or order products. This makes it possible for unauthenticated attackers who have a newsletter's view-in-browser link, for example from a copy they received themselves, to view other recipients' personalized email content by changing the queue ID.",
 "plugin": {
  "slug": "mailpoet",
  "name": "MailPoet – Newsletters, Email Marketing, and Automation",
  "full_name": "MailPoet – Newsletters, Email Marketing, and Automation",
  "wordpress_org": "https://wordpress.org/plugins/mailpoet/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mailpoet/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mailpoet"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.45.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.45.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.45.0",
 "remediation": "Update to 5.45.0 or later.",
 "fix_released": "2026-11-03T12:12:07+00:00",
 "published": "2026-11-04T14:58:24+00:00",
 "updated": "2026-11-04T13:56:57.890109+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2470/",
  "https://plugins.svn.wordpress.org/mailpoet/tags/5.45.0/",
  "https://wordpress.org/plugins/mailpoet/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mailpoet",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}