WordPress Simple Newsletter Plugin plugin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure vulnerability

Unauthenticated Subscriber PII and confirmkey Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Noptin versions 4.3.3...

CVE-2026-78146 Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Page

The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises...

CVE-2026-78146

The Simple Newsletter Plugin for WordPress (versions before 4.3.3 ) is vulnerable to an information disclosure flaw. The plugin fails to verify the identity of a requester against the subscriber named in a public request before rendering stored details. This allows unauthenticated users to access...

CVE-2026-78146 Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Page

The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises...