CVE-2026-11592: Email Subscribers Plugin Auth Bypass Flaw

CVE-2026-11592 Overview

CVE-2026-11592 is an authorization bypass vulnerability in the Email Subscribers & Newsletters plugin for WordPress, affecting all versions up to and including 5.9.27. The plugin fails to properly verify that a user is authorized to perform sensitive actions [CWE-862]. Authenticated attackers holding contributor-level access or higher can overwrite plugin mail settings, create audience lists, insert arbitrary contacts, create and overwrite newsletter broadcasts and post notifications, add workflows, and queue and dispatch mass email to arbitrary recipients.

Critical Impact
Contributor-level users can hijack the plugin's mailing infrastructure to send arbitrary bulk email from the site domain, enabling large-scale phishing and spam campaigns that abuse the site's sender reputation.

Affected Products

Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress
All versions up to and including 5.9.27
WordPress sites with the plugin installed and contributor-or-above user registration enabled

Discovery Timeline

2026-07-02 - CVE-2026-11592 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-11592

Vulnerability Analysis

The vulnerability is a missing authorization check across multiple administrative endpoints exposed by the plugin. Contributor accounts, which normally can only draft posts, gain access to functionality intended for administrators. Impacted actions span the plugin's core operations: mail sender configuration, audience list management, contact insertion, newsletter broadcast creation, post notification templates, workflow creation, and mass email dispatch.

Because the plugin routes these actions through handlers that check for authentication but not for capability, any logged-in user meeting the low privilege threshold can invoke them. The most severe operational impact is the ability to queue and dispatch mass email to attacker-controlled recipient lists using the site's configured sending infrastructure.

Root Cause

The root cause is a Missing Authorization weakness [CWE-862]. The affected handlers referenced in the Wordfence Vulnerability Analysis — including logic in class-email-subscribers-admin.php, class-ig-es-onboarding.php, class-es-newsletters.php, and class-es-workflow-admin-edit.php — verify that a request is authenticated but do not call current_user_can() with an appropriate capability such as manage_options. Nonce checks alone are insufficient because contributors can obtain valid nonces from pages they legitimately access.

Attack Vector

Exploitation requires network access to the WordPress admin interface and an authenticated session with contributor privileges or higher. The attacker sends crafted POST requests to the plugin's admin AJAX or admin-post endpoints that manage settings, lists, contacts, broadcasts, and workflows. A typical abuse path: overwrite the plugin's from_email and from_name to a spoofed identity, create an audience list, import attacker-supplied recipients, compose a broadcast containing a phishing payload, and dispatch it. The site's outbound reputation lends credibility to the message.

See the plugin source references at Email Subscribers Newsletters Class and Workflow Admin Edit Class Code for the affected handlers.

Detection Methods for CVE-2026-11592

Indicators of Compromise

Unexpected changes to the plugin's from_name or from_email sender settings in the wp_options table.
New audience lists, contacts, broadcasts, or workflows created by non-administrator user accounts.
Outbound email volume spikes originating from the WordPress host, particularly to recipient domains unrelated to the site's normal audience.
Web server access logs showing contributor-level accounts issuing POST requests to admin-ajax.php or admin-post.php with plugin action parameters such as es_ or ig_es_.

Detection Strategies

Audit WordPress user activity to correlate contributor session activity with plugin administrative actions.
Inspect the ig_es_lists, ig_es_contacts, ig_es_campaigns, and workflow tables for records created by users below the administrator role.
Alert on modifications to plugin option rows in wp_options where the associated user does not hold manage_options.

Monitoring Recommendations

Log and review all requests to wp-admin/admin-ajax.php referencing Email Subscribers actions, capturing the authenticated user role.
Monitor outbound SMTP or transactional mail API traffic for volume anomalies from the WordPress host.
Track new user registrations and role assignments, especially bulk contributor account creation preceding plugin activity.

How to Mitigate CVE-2026-11592

Immediate Actions Required

Update the Email Subscribers & Newsletters plugin to a version later than 5.9.27 once the vendor publishes a fixed release.
Audit existing WordPress user accounts and remove or downgrade unnecessary contributor-and-above accounts.
Review plugin mail settings, audience lists, contacts, and workflows for unauthorized modifications and restore known-good values.
Rotate any SMTP or API credentials stored in the plugin configuration if abuse is suspected.

Patch Information

Refer to the WordPress Change Set Details and the Wordfence Vulnerability Analysis for the vendor's remediation. The fix adds capability checks to the affected handlers so that only users with administrative capabilities can invoke plugin configuration and mailing operations.

Workarounds

Disable open registration or restrict new user role assignment to subscriber until the plugin is patched.
Deactivate the Email Subscribers & Newsletters plugin on sites that grant contributor-or-above access to untrusted users.
Deploy a web application firewall rule to block requests to plugin admin endpoints originating from sessions without the administrator role.

bash

# Disable the plugin from the command line using WP-CLI until a patch is applied
wp plugin deactivate email-subscribers

# Restrict the default role for new registrations to subscriber
wp option update default_role subscriber