CVE-2026-11592: Authorization Bypass in Email Subscribers & Newsletters WordPress Plugin

Technical summary

CVE-2026-11592 is a missing authorization check (CWE-862) in the Email Subscribers & Newsletters plugin affecting versions up to 5.9.27. The vulnerability allows authenticated contributors and above to execute privileged actions without proper capability verification, including modification of SMTP sender configuration, audience and contact management, newsletter and post notification creation, workflow manipulation, and email dispatch. The attack surface is limited to authenticated users but the permission model does not correctly restrict contributor-level accounts from administrative functions.

Business impact

Organizations using this plugin face risk of email infrastructure compromise through configuration tampering, unauthorized mailing list manipulation, and mass email dispatch that could be used for internal fraud, phishing campaigns impersonating the organization, or data exfiltration via subscriber lists. The impact is amplified in environments where contributor accounts are widely distributed among staff or external authors, since each represents a potential pivot point to email operations.

Affected systems

All versions of the Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress up to and including version 5.9.27 are vulnerable. The plugin is installed on WordPress sites; vulnerability requires an authenticated WordPress user account with contributor role or higher.

Exploitability

Exploitation requires valid WordPress credentials at the contributor level or above. No public exploit code is documented in the provided evidence. The CVSS 3.1 score of 4.3 (MEDIUM) reflects network accessibility and low attack complexity, tempered by the requirement for prior authentication. Organizations should assess how many contributors or editors exist in their WordPress environment and whether those accounts could be compromised or misused by insiders.

Remediation

Update the Email Subscribers & Newsletters plugin to a version released after 5.9.27 that implements proper authorization checks on all administrative functions. Verify the fix with the plugin vendor's security advisory to confirm that capability verification has been added for sender configuration, audience management, and bulk email dispatch functions.

Patch guidance

Check the official Email Subscribers & Newsletters plugin repository and vendor advisories for a patched version. After updating, test that contributor-level accounts can no longer modify sender settings, create or edit newsletters, or dispatch emails. Confirm that only administrator-level users retain these capabilities. If the plugin is mission-critical, consider staging the update in a test environment first.

Detection guidance

Monitor WordPress database logs and audit trails for unexpected changes to email sender metadata (from name, from email address) or creation of new audience segments and mass email jobs by non-administrator accounts. Review contributor and editor account activity around plugin settings and email campaign creation. WordPress security plugins with audit logging can help identify post-compromise anomalies if a contributor account is compromised.

Why prioritize this

This vulnerability poses a moderate but targeted risk in multi-user WordPress environments. Prioritize patching if your organization has many contributor accounts, uses the plugin for customer communications, or has strict email governance requirements. Lower priority in single-admin sites with minimal contributor usage, though patching remains recommended.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability requiring authentication (PR:L) with no complexity, but only integrity impact (I:L) and no confidentiality or availability impact in the base case. However, the actual business risk is elevated if the plugin manages customer communications or subscriber data, because unauthorized email dispatch and sender spoofing have reputational and compliance implications beyond the base score.

Frequently asked questions