{
 "id": "WPSEC-2026-2855",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2855/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2855/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2855/index.md",
 "title": "MailPoet – Newsletters, Email Marketing, and Automation <= 5.45.1 - Unauthenticated Authentication Bypass via Brute-Forceable Obsolete Subscriber Link Token Prefix",
 "description": "The MailPoet plugin for WordPress is vulnerable to Authentication Bypass via subscriber link tokens (unsubscribe and manage subscription links) in versions 5.41.0 to 5.45.1. After the plugin upgrades a subscriber's old 6-character link token, it keeps accepting just those 6 hexadecimal characters for a 12-month grace period. It also places no limit on failed guesses. This makes it possible for unauthenticated attackers to brute-force the token of a subscriber with an upgraded token. They can then open that subscriber's management and unsubscribe links, where they can view and change the subscriber's details or unsubscribe them, while the grace period is active.",
 "plugin": {
  "slug": "mailpoet",
  "name": "MailPoet – Newsletters, Email Marketing, and Automation",
  "full_name": "MailPoet – Newsletters, Email Marketing, and Automation",
  "wordpress_org": "https://wordpress.org/plugins/mailpoet/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mailpoet/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mailpoet"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-307"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.41.0",
    "from_inclusive": true,
    "to": "5.45.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.41.0 before 5.45.2"
  ]
 },
 "introduced_in": "5.41.0",
 "fixed_in": "5.45.2",
 "remediation": "Update to 5.45.2 or later.",
 "fix_released": "2026-11-10T10:09:28+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:07:03.978568+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2855/",
  "https://plugins.svn.wordpress.org/mailpoet/tags/5.45.2/",
  "https://wordpress.org/plugins/mailpoet/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mailpoet",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}