# Newsletters <= 4.18.2 - Unauthenticated Sensitive Information Exposure of Private Mailing Lists

- **ID:** WPSEC-2026-2988
- **Plugin:** Newsletters (`newsletters-lite`), https://wordpress.org/plugins/newsletters-lite/
- **Affected versions:** all versions before 4.18.3
- **Fixed in:** 4.18.3 (Update to 4.18.3 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/newsletters-lite
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2988/

## Description

The Newsletters plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.18.2 via the front-end AJAX field refresh action. This is due to mailing lists named in the request-supplied form instance being queried with private lists included. This makes it possible for unauthenticated attackers to enumerate and view private mailing lists that are not meant to be shown on public subscription forms.

## References

- https://wpsec.com/vuln/WPSEC-2026-2988/
- https://plugins.svn.wordpress.org/newsletters-lite/tags/4.18.3/
- https://wordpress.org/plugins/newsletters-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2988/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.