CVE-2026-92537 Information disclosure in Newsletter – Send awesome emails from WordPress
Unauthenticated attackers can obtain raw subscriber cookies via click-tracking URLs, enabling full PII access, profile modification, and account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92537?
CVE-2026-92537 is a medium-severity vulnerability in satollo Newsletter – Send awesome emails from WordPress, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route `/tnp/l/` is registered with `permission_callback => '__return_true'` and, upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=<id>-<raw_token>` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant. This makes it possible for unauthenticated attackers who obtain any signed click-tracking URL for a target subscriber to receive that subscriber's permanent raw authentication cookie, which they can then use to export the subscriber's full PII record via the JSON profile-export endpoint (`?na=px`), rewrite the subscriber's stored profile (`?na=ps`), and silently unsubscribe the subscriber via the RFC-8058 one-click endpoint (`?na=ocu`), none of which require a nonce, password, or email challenge. Signed tracking URLs are embedded in every external link of every newsletter delivered to a subscriber, carry no timestamp, and never expire until the site's relink key rotates, meaning that any party who observes such a URL — through a forwarded email, a shared inbox, a mail-gateway log, or Referer headers on the redirect target, which has no Referrer-Policy set — can replay it indefinitely to obtain the victim's credential.
Weakness: CWE-522
Which versions are affected by CVE-2026-92537?
How do I fix CVE-2026-92537?
No fix has been published for CVE-2026-92537 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92537 being exploited?
There is no known exploitation of CVE-2026-92537 in the wild and no public exploit code.
Sources
Also known as GHSA-r57r-xx5c-pcg3.