CVE-2026-86823

The Newsletter WordPress plugin before 9.3.7 fails to validate the redirect destination after a public subscription action, triggered via the ncu parameter. This flaw enables unauthenticated attackers to perform an open redirect to arbitrary external sites and to disclose a subscriber token , whi...