CVE-2026-92537 (GCVE-0-2026-92537)

Vulnerability from cvelistv5 – Published: 2026-10-01 02:27 – Updated: 2026-10-01 02:27
VLAI
Title
Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)
Summary
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route `/tnp/l/` is registered with `permission_callback => '__return_true'` and, upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=<id>-<raw_token>` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant. This makes it possible for unauthenticated attackers who obtain any signed click-tracking URL for a target subscriber to receive that subscriber's permanent raw authentication cookie, which they can then use to export the subscriber's full PII record via the JSON profile-export endpoint (`?na=px`), rewrite the subscriber's stored profile (`?na=ps`), and silently unsubscribe the subscriber via the RFC-8058 one-click endpoint (`?na=ocu`), none of which require a nonce, password, or email challenge. Signed tracking URLs are embedded in every external link of every newsletter delivered to a subscriber, carry no timestamp, and never expire until the site's relink key rotates, meaning that any party who observes such a URL — through a forwarded email, a shared inbox, a mail-gateway log, or Referer headers on the redirect target, which has no Referrer-Policy set — can replay it indefinitely to obtain the victim's credential.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • CWE-522 - Insufficiently Protected Credentials
Assigner
References
Impacted products
Vendor Product Version CPE status
satollo Newsletter – Send awesome emails from WordPress Affected: 0 , ≤ 9.3.9 (semver)
guessed Create a notification for this product.
Credits
Swayam
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Newsletter \u2013 Send awesome emails from WordPress",
          "vendor": "satollo",
          "versions": [
            {
              "lessThanOrEqual": "9.3.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Swayam"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Newsletter \u2013 Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin\u0027s public click-tracking REST route `/tnp/l/` is registered with `permission_callback =\u003e \u0027__return_true\u0027` and, upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=\u003cid\u003e-\u003craw_token\u003e` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant. This makes it possible for unauthenticated attackers who obtain any signed click-tracking URL for a target subscriber to receive that subscriber\u0027s permanent raw authentication cookie, which they can then use to export the subscriber\u0027s full PII record via the JSON profile-export endpoint (`?na=px`), rewrite the subscriber\u0027s stored profile (`?na=ps`), and silently unsubscribe the subscriber via the RFC-8058 one-click endpoint (`?na=ocu`), none of which require a nonce, password, or email challenge. Signed tracking URLs are embedded in every external link of every newsletter delivered to a subscriber, carry no timestamp, and never expire until the site\u0027s relink key rotates, meaning that any party who observes such a URL \u2014 through a forwarded email, a shared inbox, a mail-gateway log, or Referer headers on the redirect target, which has no Referrer-Policy set \u2014 can replay it indefinitely to obtain the victim\u0027s credential."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T02:27:46.143Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ed68a4ff-a2aa-4df7-96b1-f094bce4b9b7?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/statistics/statistics.php#L174"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/includes/module.php#L403"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/includes/module-base.php#L441"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/statistics/statistics.php#L107"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/statistics/statistics.php#L335"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/includes/module-base.php#L1209"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3709894%40newsletter%2Ftags%2F9.4.0\u0026old=3695457%40newsletter%2Ftags%2F9.3.9"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-16T13:37:46.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-30T13:32:34.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Newsletter \u003c= 9.3.9 - Unauthenticated Insufficiently Protected Credentials via \u0027/tnp/l/\u0027 Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-92537",
    "datePublished": "2026-10-01T02:27:46.143Z",
    "dateReserved": "2026-09-16T12:53:23.351Z",
    "dateUpdated": "2026-10-01T02:27:46.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Newsletter \u2013 Send awesome emails from WordPress",
                "vendor": "satollo",
                "versions": [
                  {
                    "lessThanOrEqual": "9.3.9",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@wordfence.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The Newsletter \u2013 Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin\u0027s public click-tracking REST route `/tnp/l/` is registered with `permission_callback =\u003e \u0027__return_true\u0027` and, upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=\u003cid\u003e-\u003craw_token\u003e` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant. This makes it possible for unauthenticated attackers who obtain any signed click-tracking URL for a target subscriber to receive that subscriber\u0027s permanent raw authentication cookie, which they can then use to export the subscriber\u0027s full PII record via the JSON profile-export endpoint (`?na=px`), rewrite the subscriber\u0027s stored profile (`?na=ps`), and silently unsubscribe the subscriber via the RFC-8058 one-click endpoint (`?na=ocu`), none of which require a nonce, password, or email challenge. Signed tracking URLs are embedded in every external link of every newsletter delivered to a subscriber, carry no timestamp, and never expire until the site\u0027s relink key rotates, meaning that any party who observes such a URL \u2014 through a forwarded email, a shared inbox, a mail-gateway log, or Referer headers on the redirect target, which has no Referrer-Policy set \u2014 can replay it indefinitely to obtain the victim\u0027s credential."
          }
        ],
        "id": "CVE-2026-92537",
        "lastModified": "2026-10-01T12:40:28.083",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "security@wordfence.com",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-10-01T03:16:59.667",
        "references": [
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/includes/module-base.php#L1209"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/includes/module-base.php#L441"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/includes/module.php#L403"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/statistics/statistics.php#L107"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/statistics/statistics.php#L174"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/newsletter/tags/9.3.9/statistics/statistics.php#L335"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3709894%40newsletter%2Ftags%2F9.4.0\u0026old=3695457%40newsletter%2Ftags%2F9.3.9"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ed68a4ff-a2aa-4df7-96b1-f094bce4b9b7?source=cve"
          }
        ],
        "sourceIdentifier": "security@wordfence.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-522"
              }
            ],
            "source": "security@wordfence.com",
            "type": "Primary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.