What’s Vulnerable › Vulnerabilities
CVE-2026-86824: Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key
- Severity: medium (CVSS 4.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-17 · updated 2026-09-18
- Weakness: CWE-326
Description
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.
Affected products
- satollo Newsletter – Send awesome emails from WordPress: before 9.3.8 — fixed in 9.3.8
How to fix
Upgrade to a fixed version: satollo Newsletter – Send awesome emails from WordPress 9.3.8. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-86824 or the next vulnerability affects your stack