CVE-2026-83555

MediumCVSS 5.3/10Last modified Sep 23, 2026

Description

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-835575.6DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly CVE-2026-83565.4LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement re CVE-2026-835605.3The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the CVE-2026-835617.2The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elem CVE-2026-835626.5Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.CVE-2026-835647.0Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.CVE-2026-835655.5Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.CVE-2026-835667.0Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.CVE-2026-835677.8Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-835687.8Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.CVE-2026-835697.8Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally.CVE-2026-83577.8LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made u