CVE-2026-83555: Unknown Email Subscribers & Newsletters

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know.

Affected products

• Unknown Email Subscribers & Newsletters: before 5.9.35 (fixed in 5.9.35)

Published 2026-09-23. Last modified 2026-09-23.