CVE-2026-83555: Email Subscribers WordPress Auth Bypass

CVE-2026-83555 Overview

CVE-2026-83555 is a missing authorization vulnerability [CWE-862] in the Email Subscribers & Newsletters WordPress plugin versions before 5.9.35. The plugin fails to verify the per-subscriber management token before changing a subscriber's subscription status. Unauthenticated attackers can force-unsubscribe or force-confirm any subscriber whose email address they know. The flaw is network-exploitable and requires no user interaction or authentication, though impact is limited to integrity of subscription state.

Critical Impact
Unauthenticated attackers can manipulate arbitrary subscribers' subscription status by supplying only the target email address, undermining consent tracking and mailing list integrity.

Affected Products

Email Subscribers & Newsletters WordPress plugin, all versions before 5.9.35

Discovery Timeline

2026-09-23 - CVE-2026-83555 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-83555

Vulnerability Analysis

The Email Subscribers & Newsletters plugin implements per-subscriber management links containing a token that identifies the subscriber and authorizes changes to their subscription state. These tokens are the plugin's sole authorization mechanism for unauthenticated subscribers acting on their own records.

In versions before 5.9.35, the subscription status change handler processes requests without validating that the supplied token matches the target subscriber. An attacker who knows a subscriber's email address can invoke the endpoint and modify status values such as confirmed or unsubscribed. Consent workflows, double opt-in guarantees, and list hygiene records are all affected.

The issue is classified as Missing Authorization [CWE-862]. Confidentiality is not impacted because subscriber data is not returned to the attacker. Integrity is impacted because subscription state can be altered without consent. Availability is not affected.

Root Cause

The root cause is the absence of a token comparison check within the subscription status update flow. The handler trusts request parameters that identify the target subscriber without verifying the accompanying management token. This breaks the authorization boundary intended to bind each management link to a single subscriber.

Attack Vector

Exploitation requires a network-reachable WordPress site running a vulnerable version of the plugin and knowledge of a target email address. The attacker sends a crafted HTTP request to the plugin's subscription management endpoint with the victim email and a status change parameter. The plugin processes the request without token validation and updates the subscriber record.

No authentication, elevated privileges, or user interaction are required. Attackers can automate list-wide manipulation given any leaked or guessed set of subscriber emails.

No public proof-of-concept code has been released. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-83555

Indicators of Compromise

Unexpected changes in subscriber status fields within the wp_ig_contacts or equivalent Email Subscribers database tables.
Sudden spikes in unsubscribe or confirmation events without corresponding user-originated clicks in web analytics.
Access log entries targeting the plugin's subscription management endpoints with varied email parameters and missing or invalid hash tokens.

Detection Strategies

Compare inbound requests to the plugin's subscription endpoints against records of legitimate management links issued to subscribers.
Correlate subscription status changes with source IP address diversity; a single IP toggling many subscribers indicates abuse.
Review the plugin's audit logs, where available, for status changes that lack an associated user click event.

Monitoring Recommendations

Enable verbose HTTP access logging on the WordPress front controller and retain logs for at least 90 days.
Alert on high request volume to Email Subscribers management URLs from single source addresses.
Monitor mailing list opt-in and opt-out rates for statistical anomalies that may indicate mass tampering.

How to Mitigate CVE-2026-83555

Immediate Actions Required

Upgrade the Email Subscribers & Newsletters plugin to version 5.9.35 or later on all WordPress installations.
Audit recent subscriber status changes and restore any records altered without a corresponding legitimate management action.
Rotate any exposed subscriber management tokens if the plugin supports regeneration.

Patch Information

The vendor addressed the issue in Email Subscribers & Newsletters version 5.9.35 by enforcing per-subscriber token validation before applying subscription status changes. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict access to the plugin's subscription management endpoints at the web application firewall (WAF) layer, requiring a valid hash parameter of expected length.
Temporarily disable the Email Subscribers & Newsletters plugin on sites that cannot be patched immediately.
Rate-limit requests to /?es=unsubscribe and related endpoints to slow automated abuse against known subscriber lists.

bash

# Example WAF rule (ModSecurity) enforcing presence of the management token
SecRule REQUEST_URI "@contains es=unsubscribe" \
    "id:1008555,phase:1,deny,status:403,\
    chain,msg:'Email Subscribers request missing management token'"
    SecRule &ARGS:hash "@eq 0"