CVE-2019-19980

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users Subscriber or greater access to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wpajax...

CVE-2019-19984

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with editpost capabilities to manage plugin settings and email campaigns...

CVE-2019-19981

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings...

Privilege escalation

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users Subscriber or greater access to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wpajax...

Design/Logic Flaw

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...

Information disclosure

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure...

Cross site request forgery (csrf)

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings...

Code injection

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with editpost capabilities to manage plugin settings and email campaigns...

CVE-2019-19980

The CVE-2019-19980 entry concerns the WordPress plugin Email Subscribers & Newsletters prior to version 4.2.3. Root cause: the plugin registers a wp_ajax send_test_email function, enabling a privilege-bypass that lets authenticated users (Subscriber and higher) send test emails from the admin das...

CVE-2019-19980

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users Subscriber or greater access to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wpajax...

CVE-2019-19981

CVE-2019-19981 affects the WordPress plugin Email Subscribers & Newsletters (before 4.2.3). The vulnerability is a CSRF flaw that can be exploited to impact all plugin settings. Remediation observed in public sources is to update to version 4.2.3 or later. Additional connected feeds note broader ...

CVE-2019-19982

The CVE-2019-19982 entry concerns the WordPress plugin Email Subscribers & Newsletters prior to version 4.2.3 . The vulnerability allows unauthenticated option creation when an attacker sends a request to /wp-admin/admin-post.php?es_skip=1&option_name= , enabling modification of plugin options wi...

CVE-2019-19982

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...

CVE-2019-19984

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with editpost capabilities to manage plugin settings and email campaigns...

CVE-2019-19984

The CVE-2019-19984 entry describes a vulnerability in the WordPress plugin Email Subscribers & Newsletters before version 4.2.3 where users with edit_post privileges could manage plugin settings and email campaigns. The issue is a privilege/AC (access control) weakness allowing low-privilege user...

CVE-2019-19985

The Email Subscribers & Newsletters WordPress plugin, specifically versions prior to 4.2.3 , contains a flaw allowing unauthenticated file download and user information disclosure . An attacker can exploit this vulnerability to retrieve sensitive files from the server, potentially leading to data...

CVE-2019-19980: Undefined Security Weakness

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users Subscriber or greater access to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wpajax...

PT-2019-16032

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters versions prior to 4.2.3 Description The issue allows for unauthenticated option creation. To exploit this, an attacker would need to send a request to the "wp-admin/admin-post.php?es skip=1&option name=" endpoin...

PT-2019-16030

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters versions prior to 4.2.3 Description The issue allows authenticated users with Subscriber or greater access to send test emails from the administrative dashboard on behalf of an administrator. This occurs because...

PT-2019-16031

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters versions prior to 4.2.3 Description The issue allows for CSRF exploitation on all plugin settings, potentially affecting the security of the plugin's configuration. Recommendations For versions prior to 4.2.3,...