CVE-2026-107097: Unknown Royal Addons for Elementor: The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using…

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses...

EUVD-2026-85021

The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record...

PT-2026-97157

Name of the Vulnerable Software and Affected Versions Newsletters WordPress plugin versions prior to 4.18.1 Description The plugin fails to perform ownership checks on certain subscriber management actions and grants management sessions to unauthenticated visitors upon request. This allows...

Security expert Troy Hunt hit by phishing attack

Internet security expert and educator Troy Hunt disclosed this week that he had been hit by one of the oldest—and most proven—scams in the online world: A phishing attack. Through an automated attack disguised as a notice from Hunt’s chosen newsletter provider Mailchimp, scammers stole roughly...