CVE-2026-92537 describes an insufficiently protected credentials vulnerability in the Newsletter – Send awesome emails from WordPress plugin versions up to and including 9.3.9. The plugin's public REST route `/tnp/l/` is registered with a permission callback that always returns true, allowing unauthenticated access. When a valid keyed-MD5 signature is presented, the route calls `set_user_cookie()`, which emits a Set-Cookie header containing the subscriber's permanent raw authentication token. This occurs because the subscriber object lacks a `_trusted` property, causing the raw token to be returned instead of a masked variant. Attackers with any signed click-tracking URL can obtain this cookie and use it to export the subscriber's full PII via the JSON profile-export endpoint, rewrite the subscriber profile, or silently unsubscribe the subscriber via the one-click unsubscribe endpoint. Signed tracking URLs are embedded in every newsletter link, carry no timestamp, and never expire until the relink key rotates, allowing indefinite replay by anyone who observes these URLs through forwarded emails, shared inboxes, mail-gateway logs, or Referer headers.

An unauthenticated attacker who obtains any signed click-tracking URL for a subscriber can retrieve that subscriber's permanent raw authentication cookie. With this cookie, the attacker can export the subscriber's full personally identifiable information (PII), modify the subscriber's stored profile, and silently unsubscribe the subscriber without any further authentication. The vulnerability exposes subscriber data confidentiality and integrity, and allows unauthorized profile manipulation and subscription changes. The signed URLs do not expire until the relink key rotates, enabling indefinite exploitation if URLs are observed or intercepted.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider rotating the site's relink key to invalidate existing signed URLs and limit exposure. Additionally, restricting access to click-tracking URLs and monitoring for unusual subscriber profile changes may help mitigate risk. Avoid forwarding newsletters or exposing signed URLs in logs or referer headers where possible.