UNKNOWN NVD

CVE-2026-86824

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unke

The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.

References

https://wpscan.com/vulnerability/62ee25d9-ec38-402c-9959-37fd89708aca/

Published: 2026-09-17 · Source: NVD · Feed updated: 2026-09-17

This unknown severity vulnerability was published on 2026-09-17 via NVD.

vulnfeed aggregates 8294 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.