Medium severity6.5NVD Advisory· Published Aug 26, 2026· Updated Aug 26, 2026
CVE-2026-78146
CVE-2026-78146
Description
The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises changes to their record.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <4.3.3
Patches
Vulnerability mechanics
References
1News mentions
2- Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)Wordfence Blog · Sep 3, 2026
- WordPress: 25 Plugins and Themes Hit by Vulnerabilities, Including Critical RCE and File Upload FlawsVypr Intelligence · Aug 26, 2026