CVE-2026-83555 Missing authorization in Email Subscribers & Newsletters
Unauthenticated attackers can force-unsubscribe or confirm arbitrary subscribers by bypassing token verification in the Email Subscribers plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-83555?
CVE-2026-83555 is a medium-severity missing authorization vulnerability in Unknown Email Subscribers & Newsletters, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know.
Weakness: CWE-862
Which versions are affected by CVE-2026-83555?
How do I fix CVE-2026-83555?
No fix has been published for CVE-2026-83555 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-83555 being exploited?
There is no known exploitation of CVE-2026-83555 in the wild and no public exploit code.
Sources
Also known as GHSA-52g9-h9fh-xgf2.