A broken access control flaw exists in the newsletters_subscribers component of the WordPress Newsletters plugin versions 4.13 and earlier. The vulnerability removes or bypasses the permission check that should restrict who can view subscriber information, allowing an attacker to retrieve personal details of newsletter recipients. Exposure of that data can compromise confidentiality and potentially enable further social engineering or credential‑replay attacks.

The affected product is Tribulant Software’s Newsletters plugin for WordPress. Any installation using version 4.13 or earlier is vulnerable; later releases are not affected.

The vulnerability carries a CVSS score of 8.1, indicating a high severity while the EPSS score is not available at this time and the CVE is not listed in the CISA KEV catalog. The likely attack vector is remote, leveraging the public WordPress interface or an authenticated user account with sufficient privileges to access subscriber endpoints. Once the attacker reads the subscriber list, they can obtain personally identifying information that may be used in targeted attacks.