MailPoet – Newsletters, Email Marketing, and Automation <= 5.45.1 - Unauthenticated Authentication Bypass via Brute-Forceable Obsolete Subscriber Link Token Prefix
- ID
- WPSEC-2026-2855
- Plugin
- MailPoet – Newsletters, Email Marketing, and Automation (mailpoet)
- Affected
- from 5.41.0 before 5.45.2
- Remediation
- Update to 5.45.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-307
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- MailPoet – Newsletters, Email Marketing, and Automation on WPSec AttackSurface
- Fix released
- Published
Description
The MailPoet plugin for WordPress is vulnerable to Authentication Bypass via subscriber link tokens (unsubscribe and manage subscription links) in versions 5.41.0 to 5.45.1. After the plugin upgrades a subscriber's old 6-character link token, it keeps accepting just those 6 hexadecimal characters for a 12-month grace period. It also places no limit on failed guesses. This makes it possible for unauthenticated attackers to brute-force the token of a subscriber with an upgraded token. They can then open that subscriber's management and unsubscribe links, where they can view and change the subscriber's details or unsubscribe them, while the grace period is active.
References
- https://wpsec.com/vuln/WPSEC-2026-2855/
- https://plugins.svn.wordpress.org/mailpoet/tags/5.45.2/
- https://wordpress.org/plugins/mailpoet/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS