CVE-2026-86823 Newsletter < 9.3.7 - Unauthenticated Open Redirect and Subscriber Token Disclosure via ncu Parameter
Unauthenticated attackers can redirect users to malicious sites and disclose subscriber tokens via the ncu parameter in the Newsletter plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86823?
CVE-2026-86823 is a medium-severity vulnerability in Unknown Newsletter, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber record's front-end actions.
Weakness: CWE-601
Which versions are affected by CVE-2026-86823?
How do I fix CVE-2026-86823?
No fix has been published for CVE-2026-86823 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-86823 being exploited?
There is no known exploitation of CVE-2026-86823 in the wild and no public exploit code.
Sources
Also known as GHSA-xhvp-v8j9-2mrf.