Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-97074 EUVD-2026-89894GHSA-px7h-jc96-f274

WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability

Published Sep 30, 2026 · Updated Sep 30, 2026 · Assigned by Patchstack

Vendor: Omnisend Product: Newsletters, Email Marketing, SMS and Popups by Omnisend

Description

Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.

Affected products

VendorProductAffectedFixed
Omnisend Newsletters, Email Marketing, SMS and Popups by Omnisend ≤ 1.9.0 —

References