The vulnerability arises because the Newsletter WordPress plugin fails to validate the target URL supplied during a public subscription process. This omission permits an attacker to supply a malicious URL and redirect unsuspecting users to arbitrary external sites, thereby enabling phishing or other social‑engineering attacks. In addition, the same flaw leaks the subscriber token that grants access to the subscriber record’s front‑end actions, exposing a sensitive credential that could be abused for unauthorized account activity or content manipulation. The combination of an open redirect and a token disclosure represents a significant privacy and security risk, as both affect confidentiality and trust in the application.

Systems running the Newsletter WordPress plugin version earlier than 9.3.7 are impacted. The attack does not depend on any user‑authentication, so any publicly accessible WordPress site that has this plugin installed and enabled is vulnerable. No specific host or domain information is provided, but the risk applies to all affected installations regardless of geographic location.

The EPSS score is reported as less than 1%, indicating a very low but non‑zero likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The attack path is simple: an attacker crafts a subscription link that points to the vulnerable plugin’s redirect endpoint with a malicious ncu parameter. When a user clicks that link, the plugin redirects the browser to the supplied address while simultaneously returning the subscriber token in the response. Because the flaw is unauthenticated, it can be exploited against any user visiting the site, though the actual exploitation would depend on successful social‑engineering or user interest in subscribing.