PT-2019-16035

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters versions prior to 4.2.3 Description The issue allowed unauthenticated file download, resulting in user information disclosure. Recommendations For versions prior to 4.2.3, update to version 4.2.3 or later to...

PT-2019-16032

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters versions prior to 4.2.3 Description The issue allows for unauthenticated option creation. To exploit this, an attacker would need to send a request to the "wp-admin/admin-post.php?es skip=1&option name=" endpoin...

PT-2019-16030

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters versions prior to 4.2.3 Description The issue allows authenticated users with Subscriber or greater access to send test emails from the administrative dashboard on behalf of an administrator. This occurs because...

PT-2019-16031

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters versions prior to 4.2.3 Description The issue allows for CSRF exploitation on all plugin settings, potentially affecting the security of the plugin's configuration. Recommendations For versions prior to 4.2.3,...

CVE-2019-19981: Cross-Site Request Forgery (CSRF)

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings...

CVE-2019-19984: Incorrect Authorization

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with editpost capabilities to manage plugin settings and email campaigns...

PT-2019-16034

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters versions prior to 4.2.3 Description The issue allows users with edit post capabilities to manage plugin settings and email campaigns, which is a flaw in the access control mechanism. Recommendations For versions...

WordPress Email Subscribers & Newsletters Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. A cross-site request forgery vulnerability...

WordPress Email Subscribers & Newsletters Unauthenticated File Download Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. An unauthenticated file download vulnerabili...

Unspecified Vulnerability in WordPress Email Subscribers & Newsletters

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. A security vulnerability exists in Email...

WordPress Email Subscribers & Newsletters Elevation of Privilege Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. An elevation of privilege vulnerability exis...

CVE-2019-19982: Improper Authentication

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...

CVE-2019-19985: Missing Authorization

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure...

WordPress Email Subscribers & Newsletters Unauthenticated Options Creation Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. An unauthenticated option creation...

Email Subscribers & Newsletters Plugin for WordPress < 4.3.1 Multiple Vulnerabilities

The WordPress Email Subscribers & Newsletters Plugin installed on the remote host is affected by unauthenticated file download, SQL injection, insecure permissions on dashboard and settings, cross-site request forgery on settings and unauthenticated option creation vulnerabilities. Note that the...

WordPress Email Subscribers & Newsletters Plugin CVE-2019-19980 Security Bypass Vulnerability

Description The Email Subscribers Newsletters Plugin for WordPress is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may aid in further attacks. Versions prior to Email Subscribers Newslette...

WordPress Email Subscribers & Newsletters Plugin Cross Site Request Forgery Vulnerability

Description The Email Subscribers Newsletters Plugin for WordPress is prone to a cross-site request-forgery vulnerability. An attacker can exploit this issue to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. Versions prior to Ema...

WordPress Email Subscribers & Newsletters Plugin Multiple Security Bypass Vulnerabilities

Description The Email Subscribers Newsletters Plugin for WordPress is prone to multiple security-bypass vulnerabilities. Attackers can exploit these issues to bypass certain security restrictions and perform unauthorized actions. This may aid in further attacks. Versions prior to Email Subscriber...

WordPress Email Subscribers & Newsletters plugin <=4.2.2 - Multiple security issues

Multiple security issues found by WordFence in WordPress Email Subscribers & Newsletters plugin versions =4.2.2. Solution Update the WordPress Email Subscribers & Newsletters plugin to the latest available version at least 4.2.3...

Email Subscribers & Newsletters < 4.2.3 - Multiple Issues

- Unauthenticated File Download leading to Information Disclosure - Blind SQL Injection in INSERT statement - Insecure Permissions on Dashboard and Settings - CSRF on Settings - Send Test Emails from the Administrative Dashboard as an Authenticated User with a role of Subscriber and above -...