CVE-2026-11592

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress versions prior to 5.9.28

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or higher can exploit this via the ig es handle request AJAX action. This allows them to overwrite mail settings such as the from name and from email address, create audience lists, insert arbitrary contacts into those lists, create and overwrite newsletter broadcasts and post notifications, add workflows, and queue and dispatch mass emails to arbitrary recipients.

Recommendations Update the plugin to a version newer than 5.9.27.