CVE-2026-78146 Overview
CVE-2026-78146 is an information disclosure vulnerability in the Simple Newsletter Plugin for WordPress before version 4.3.3. The plugin fails to verify that the requester of a public subscriber action is the subscriber referenced in the request. Unauthenticated attackers can retrieve a subscriber's stored personal data along with the authorization key that permits modifications to that subscriber record. The flaw is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated remote attackers can disclose subscriber personal data and obtain the key required to modify subscription records without user interaction.
Affected Products
- Simple Newsletter Plugin for WordPress versions prior to 4.3.3
- WordPress sites with the plugin installed and publicly accessible
- Any environment relying on the plugin's public subscriber management endpoints
Discovery Timeline
- 2026-08-26 - CVE-2026-78146 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-78146
Vulnerability Analysis
The Simple Newsletter Plugin exposes public endpoints that render subscriber details in response to requests referencing a subscriber identifier. The plugin renders the record without confirming that the requester owns the subscriber account referenced in the request. The response includes personally identifiable information along with the authorization key that the plugin uses to gate subsequent record changes.
Because the disclosed key doubles as the authorization token for changes, exposure converts a read-only disclosure into a pathway for unauthorized modification of subscription state. Attackers can enumerate subscribers and harvest both personal data and modification keys at scale. This category of flaw is tracked as [CWE-200].
Root Cause
The root cause is missing authorization on a public request handler. The plugin renders subscriber details based solely on an identifier supplied in the request. It does not require the requester to prove possession of the subscriber's email, session, or existing token before returning stored data and the change-authorization key.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted HTTP requests to the plugin's public subscriber endpoint on a vulnerable WordPress site. The server responds with the targeted subscriber's stored personal data and the key that authorizes changes to their record. Refer to the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-78146
Indicators of Compromise
- Repeated unauthenticated HTTP requests to the plugin's public subscriber endpoints from a single source or distributed IP range
- Sequential or enumerative access patterns targeting subscriber identifiers in URL parameters
- Outbound responses containing subscriber email addresses paired with authorization keys returned to non-owner IP addresses
Detection Strategies
- Inspect web server access logs for high-volume GET requests to WordPress query strings referencing the newsletter plugin's public actions
- Correlate requests for subscriber records with the source IP's prior interaction history to identify unrelated third-party access
- Deploy web application firewall rules that flag responses containing subscriber PII fields when the requester lacks a matching authenticated session
Monitoring Recommendations
- Alert on WordPress plugin version telemetry showing Simple Newsletter Plugin below 4.3.3 across managed sites
- Monitor for anomalous spikes in subscriber-management endpoint traffic against baseline volumes
- Track modifications to subscriber records that originate from IPs with no prior authenticated session
How to Mitigate CVE-2026-78146
Immediate Actions Required
- Upgrade the Simple Newsletter Plugin to version 4.3.3 or later on every WordPress instance
- Audit subscriber records for unexpected modifications and rotate any authorization keys that may have been exposed
- Restrict access to the plugin's public endpoints via WAF rules until the patch is applied
Patch Information
Upgrade to Simple Newsletter Plugin version 4.3.3 or later. The maintainers addressed the missing authorization check in this release. Consult the WPScan Vulnerability Report for advisory details and version confirmation.
Workarounds
- Temporarily deactivate the Simple Newsletter Plugin if the patch cannot be applied immediately
- Block unauthenticated access to the plugin's subscriber-management URLs at the reverse proxy or WAF layer
- Enforce rate limiting on newsletter endpoints to slow enumeration attempts against subscriber identifiers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
