CVE-2026-16264: Unknown Newsletters

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address.

Affected products

• Unknown Newsletters: before 4.18.1 (fixed in 4.18.1)

Published 2026-09-23. Last modified 2026-09-23.