# MailPoet – Newsletters, Email Marketing, and Automation <= 5.44.0 - Unauthenticated Sensitive Information Exposure via View in Browser

- **ID:** WPSEC-2026-2470
- **Plugin:** MailPoet – Newsletters, Email Marketing, and Automation (`mailpoet`), https://wordpress.org/plugins/mailpoet/
- **Affected versions:** all versions before 5.45.0
- **Fixed in:** 5.45.0 (Update to 5.45.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mailpoet
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2470/

## Description

The MailPoet plugin for WordPress is vulnerable to Sensitive Information Exposure via the View in Browser feature in all versions up to, and including, 5.44.0. This is due to the plugin returning the stored rendered body of any sending queue that belongs to the requested newsletter without checking that the viewer is the recipient of that queue or an email manager. Welcome and automation emails store one recipient's rendered body per queue, and that body can hold recipient-specific content such as generated coupon codes and cart or order products. This makes it possible for unauthenticated attackers who have a newsletter's view-in-browser link, for example from a copy they received themselves, to view other recipients' personalized email content by changing the queue ID.

## References

- https://wpsec.com/vuln/WPSEC-2026-2470/
- https://plugins.svn.wordpress.org/mailpoet/tags/5.45.0/
- https://wordpress.org/plugins/mailpoet/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2470/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.