The Newsletter plugin for WordPress is vulnerable to an unauthenticated credential disclosure flaw triggered via its public click‑tracking REST route "/tnp/l/". A signed click‑tracking URL that contains a keyed‑MD5 signature allows an attacker to call set_user_cookie(), which returns a Set‑Cookie header containing the subscriber’s permanent raw authentication token because the internal trust flag is missing. Using this token an attacker can export, modify, or delete subscriber data through JSON profile‑export, profile‑rewrite, and one‑click unsubscribe endpoints, all of which require no nonce, password, or email challenge.

Systems impacted by this flaw are installations of the "Newsletter – Send awesome emails from WordPress" plugin version 9.3.9 or earlier on any WordPress site. No other WordPress components are directly affected.

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score is not available and the flaw is not listed in the CISA KEV catalog. Attackers who obtain a signed click‑tracking URL – for example by monitoring email traffic or receiving forwarded messages – can reuse the URL indefinitely because it contains no expiration. The flaw can be exploited without prior authentication, meaning the risk remains high for any site that continues to serve newsletters containing the vulnerable click linking functionality.