Vulnerabilities / Newsletters / WPSEC-2026-2988
Newsletters <= 4.18.2 - Unauthenticated Sensitive Information Exposure of Private Mailing Lists
Medium 5.3
CWE-200Fixed in 4.18.3
- ID
- WPSEC-2026-2988
- Plugin
- Newsletters (newsletters-lite)
- Affected
- all versions before 4.18.3
- Remediation
- Update to 4.18.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Newsletters on WPSec AttackSurface
- Fix released
- Published
Description
The Newsletters plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.18.2 via the front-end AJAX field refresh action. This is due to mailing lists named in the request-supplied form instance being queried with private lists included. This makes it possible for unauthenticated attackers to enumerate and view private mailing lists that are not meant to be shown on public subscription forms.
References
- https://wpsec.com/vuln/WPSEC-2026-2988/
- https://plugins.svn.wordpress.org/newsletters-lite/tags/4.18.3/
- https://wordpress.org/plugins/newsletters-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS