CVE-2026-86824

Name of the Vulnerable Software and Affected Versions Newsletter WordPress plugin versions prior to 9.3.8

Description The plugin fails to generate its email tracking signing key with sufficient entropy and utilizes an unkeyed hash to sign tracking links. This allows an unauthenticated attacker who recovers the key offline to forge tracking links, obtain session tokens for any subscriber, and subsequently read or modify the stored personal data of those subscribers.

Recommendations Update the Newsletter WordPress plugin to version 9.3.8 or later.