CVE-2026-83555

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters WordPress plugin versions prior to 5.9.35

Description The plugin fails to verify the per-subscriber management token when modifying a subscriber's subscription status. This allows unauthenticated users to force-unsubscribe or force-confirm any subscriber if the attacker knows the target's email address.

Recommendations Update the plugin to version 5.9.35 or later.