WordPress Plugin Vulnerabilities

Newsletters, Email Marketing, SMS and Popups by Omnisend < 1.9.1 - Authenticated (Subscriber+) Insecure Direct Object Reference

Description

The Newsletters, Email Marketing, SMS and Popups by Omnisend plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.0. This is due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
omnisend
Fixed in 1.9.1

References

CVE
CVE-2026-97074
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/01538008-bdd2-43f6-962d-5d97f38d9c10

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
elaprendiz1927
Verified
No
WPVDB ID
59d60279-12bd-4f0e-93ec-0e3b113d291a

Timeline

Publicly Published
2026-09-30 (about 17 days ago)
Added
2026-09-30 (about 16 days ago)
Last Updated
2026-09-30 (about 16 days ago)

Other

Published
Title
Published
2026-07-13
Title
Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation
Published
2026-01-02
Title
Innovio <= 1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-07-27
Title
DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR
Published
2026-09-02
Title
PublishPress Permissions: Access Control, Content Permissions, User Access < 4.8.4 - Unauthenticated Insecure Direct Object Reference
Published
2026-07-10
Title
WCFM – Frontend Manager for WooCommerce < 6.7.28 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation via Multiple AJAX Handlers