PT-2019-16030 · Icegram · Email Subscribers & Newsletters

Published 2019-12-26 · Updated 2020-08-24 · CVE-2019-19980

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters versions prior to 4.2.3

Description The issue allows authenticated users with Subscriber or greater access to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wp ajax function to send test emails, specifically the send test email function.

Recommendations For versions prior to 4.2.3, update to version 4.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrative dashboard or limiting the privileges of authenticated users to prevent exploitation.

Exploit

Fix

Related Identifiers

CVE-2019-19980

Affected Products

Email Subscribers & Newsletters

References · 4

• 🔥 https://wordfence.com/blog/2019/11/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin · Exploit
• https://osv.dev/vulnerability/CVE-2019-19980 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19980 · Security Note
• https://wpvulndb.com/vulnerabilities/9946 · Note