CVE-2026-86824CWE-326

CVE-2026-86824

Medium · published September 17, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
4.0
In the wild
Unconfirmed
What it is

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00152 · 4.0th percentile
Weakness
CWE-326 · Inadequate Encryption Strength
Published
2026-09-17T10:16Z
References (1)
https://wpscan.com/vulnerability/62ee25d9-ec38-402c-9959-37fd89708aca/ · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 17 SEP 06:00Z
    Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key
    cvelistv5