https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 15:49:24 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-92537 <p>The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin&#39;s public click-tracking REST route `/tnp/l/` is registered with `permission_callback =&gt; &#39;__return_true&#39;` and, upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=&lt;id&gt;-&lt;raw_token&gt;` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant. This makes it possible for unauthenticated attackers who obtain any signed click-tracking URL for a target subscriber to receive that subscriber&#39;s permanent raw authentication cookie, which they can then use to export the subscriber&#39;s full PII record via the JSON profile-export endpoint (`?na=px`), rewrite the subscriber&#39;s stored profile (`?na=ps`), and silently unsubscribe the subscriber via the RFC-8058 one-click endpoint (`?na=ocu`), none of which require a nonce, password, or email challenge. Signed tracking URLs are embedded in every external link of every newsletter delivered to a subscriber, carry no timestamp, and never expire until the site&#39;s relink key rotates, meaning that any party who observes such a URL — through a forwarded email, a shared inbox, a mail-gateway log, or Referer headers on the redirect target, which has no Referrer-Policy s…</p> <p>The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin&#39;s public click-tracking REST route `/tnp/l/` is registered with `permission_callback =&gt; &#39;__return_true&#39;` and, upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=&lt;id&gt;-&lt;raw_token&gt;` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant. This makes it possible for unauthenticated attackers who obtain any signed click-tracking URL for a target subscriber to receive that subscriber&#39;s permanent raw authentication cookie, which they can then use to export the subscriber&#39;s full PII record via the JSON profile-export endpoint (`?na=px`), rewrite the subscriber&#39;s stored profile (`?na=ps`), and silently unsubscribe the subscriber via the RFC-8058 one-click endpoint (`?na=ocu`), none of which require a nonce, password, or email challenge. Signed tracking URLs are embedded in every external link of every newsletter delivered to a subscriber, carry no timestamp, and never expire until the site&#39;s relink key rotates, meaning that any party who observes such a URL — through a forwarded email, a shared inbox, a mail-gateway log, or Referer headers on the redirect target, which has no Referrer-Policy s…</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-92537 https://vulnerability.circl.lu/vuln/ghsa-r57r-xx5c-pcg3 <p>The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin&#39;s public click-tracking REST route `/tnp/l/` is registered with `permission_callback =&gt; &#39;__return_true&#39;` and, upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=&lt;id&gt;-&lt;raw_token&gt;` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant. This makes it possible for unauthenticated attackers who obtain any signed click-tracking URL for a target subscriber to receive that subscriber&#39;s permanent raw authentication cookie, which they can then use to export the subscriber&#39;s full PII record via the JSON profile-export endpoint (`?na=px`), rewrite the subscriber&#39;s stored profile (`?na=ps`), and silently unsubscribe the subscriber via the RFC-8058 one-click endpoint (`?na=ocu`), none of which require a nonce, password, or email challenge. Signed tracking URLs are embedded in every external link of every newsletter delivered to a subscriber, carry no timestamp, and never expire until the site&#39;s relink key rotates, meaning that any party who observes such a URL — through a forwarded email, a shared inbox, a mail-gateway log, or Referer headers on the redirect target, which has no Referrer-Policy s…</p> <p>The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin&#39;s public click-tracking REST route `/tnp/l/` is registered with `permission_callback =&gt; &#39;__return_true&#39;` and, upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=&lt;id&gt;-&lt;raw_token&gt;` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant. This makes it possible for unauthenticated attackers who obtain any signed click-tracking URL for a target subscriber to receive that subscriber&#39;s permanent raw authentication cookie, which they can then use to export the subscriber&#39;s full PII record via the JSON profile-export endpoint (`?na=px`), rewrite the subscriber&#39;s stored profile (`?na=ps`), and silently unsubscribe the subscriber via the RFC-8058 one-click endpoint (`?na=ocu`), none of which require a nonce, password, or email challenge. Signed tracking URLs are embedded in every external link of every newsletter delivered to a subscriber, carry no timestamp, and never expire until the site&#39;s relink key rotates, meaning that any party who observes such a URL — through a forwarded email, a shared inbox, a mail-gateway log, or Referer headers on the redirect target, which has no Referrer-Policy s…</p> https://vulnerability.circl.lu/vuln/ghsa-r57r-xx5c-pcg3