PT-2019-16030 · Icegram · Email Subscribers & Newsletters

Publicado 2019-12-26 · Atualizado 2020-08-24 · CVE-2019-19980

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters versions prior to 4.2.3

Description The issue allows authenticated users with Subscriber or greater access to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wp ajax function to send test emails, specifically the send test email function.

Recommendations For versions prior to 4.2.3, update to version 4.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrative dashboard or limiting the privileges of authenticated users to prevent exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2019-19980

Produtos afetados

Email Subscribers & Newsletters

Referências · 4

• 🔥 https://wordfence.com/blog/2019/11/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin · Exploit
• https://osv.dev/vulnerability/CVE-2019-19980 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19980 · Nota de Segurança
• https://wpvulndb.com/vulnerabilities/9946 · Nota