{
 "id": "WPSEC-2026-2988",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2988/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2988/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2988/index.md",
 "title": "Newsletters <= 4.18.2 - Unauthenticated Sensitive Information Exposure of Private Mailing Lists",
 "description": "The Newsletters plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.18.2 via the front-end AJAX field refresh action. This is due to mailing lists named in the request-supplied form instance being queried with private lists included. This makes it possible for unauthenticated attackers to enumerate and view private mailing lists that are not meant to be shown on public subscription forms.",
 "plugin": {
  "slug": "newsletters-lite",
  "name": "Newsletters",
  "full_name": "Newsletters",
  "wordpress_org": "https://wordpress.org/plugins/newsletters-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/newsletters-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/newsletters-lite"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.18.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.18.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.18.3",
 "remediation": "Update to 4.18.3 or later.",
 "fix_released": "2026-11-10T18:16:01+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:14:56.249570+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2988/",
  "https://plugins.svn.wordpress.org/newsletters-lite/tags/4.18.3/",
  "https://wordpress.org/plugins/newsletters-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/newsletters-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}