Skip to content
Sign in
4.8 Medium

CVE-2026-86824 The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy…

Description

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.

Affected products and versions

Product Affected versions Fixed in
Newsletter 9.3 earliest → < 9.3.8 9.3.8

Other CVEs of Newsletter

The 6 CVEs of Newsletter →
CVE-2026-86823 The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public… 5.3 Medium CVE-2025-3582 The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow… 4.8 Medium CVE-2025-3581 The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before… 4.8 Medium CVE-2025-3584 The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which… 4.8 Medium
Track this CVE