The WordPress plugin Email Subscribers & Newsletters contains a flaw that allows anyone who knows a subscriber’s email address to alter that subscriber’s subscription status without authentication. The missing token verification means the plugin accepts status change requests that are not tied to a unique per‑subscriber token, effectively turning the endpoint into an open way to subscribe or unsubscribe users at will. This can be used to remove legitimate subscribers from mailing lists, prevent them from receiving content, or add them to spam lists, impacting the availability and confidentiality of communications.

WordPress sites using the Email Subscribers & Newsletters plugin version earlier than 5.9.35 are affected. The vulnerability is identified at the plugin level rather than the host WordPress core.

The CVSS score of 5.3 indicates a moderate level of severity. The EPSS score of 0.00186 suggests a very low probability of exploitation, indicating that public evidence of exploitation is lacking. The issue remains unpatched and the attack can be performed by anyone with knowledge of the target email address through a simple HTTP request. Because the flaw is not listed in the CISA KEV catalog and no known exploit code is publicly disclosed, the likelihood of immediate exploitation is low, yet the potential impact to subscriber lists warrants prompt remediation.