CVE-2026-11592 Details

A vulnerability allowing authorization bypass has been identified in the Email Subscribers & Newsletters WordPress plugin, affecting all versions up to and including 5.9.27. The issue arises because the plugin fails to properly verify user authorization for certain actions. This flaw enables authenticated attackers with contributor-level access or higher to manipulate various plugin settings and features. Specifically, they can overwrite email settings, create and manage audience lists, insert contacts into these lists, and control newsletter broadcasts and post notifications. Additionally, this vulnerability allows the addition of workflows and the mass dispatch of emails to selected recipients.