Newsletter leaks subscriber tokens through an unrestricted redirect
Newsletter before 9.3.7: An unauthenticated attacker can control the destination of a redirect after a public subscription action. Redirecting a visitor to an external site can disclose a subscriber token that authorizes front-end actions for that subscriber record. The export does not identify the destination parameter, token transport or precise actions granted; it does not establish WordPress account takeover.
- Component
- Newsletter
- Plugin slug
newsletter- Affected
- < 9.3.7
- Safe version
9.3.7- Published
- Sep 16, 2026
This CVE was published Sep 16, 2026 and is one of 21 known issues for this plugin.
Update, patch or deactivate.
Update Newsletter to 9.3.7 or later. Restrict redirect destinations to approved local URLs and avoid carrying subscriber tokens into external navigation. Invalidate exposed tokens and review subscriber changes where misuse is suspected.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber record's front-end actions.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N