CVE-2026-11592 is an authorization bypass vulnerability (CWE-862) affecting the Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress. The plugin fails to properly verify that users are authorized to perform certain actions. As a result, authenticated users with contributor-level privileges or above can overwrite plugin mail settings (including 'from' name and email), create and manipulate audience lists and contacts, manage newsletter broadcasts and post notifications, add workflows, and queue and send mass emails to arbitrary recipients. This vulnerability affects all plugin versions up to and including 5.9.27.

The vulnerability allows an attacker with contributor-level access or higher to bypass authorization controls and manipulate email marketing settings and content. This can lead to unauthorized mass email dispatches, potentially facilitating spam, phishing, or other malicious campaigns. While confidentiality and availability impacts are not indicated, the integrity of email communications and subscriber data is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity related to email settings and mass mail dispatches. Avoid granting unnecessary privileges to users to reduce risk.