Description
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download EDB-48698 · webapps · Jul 26, 2020
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress Email Subscribers & Newsletters <4.2.3 - Arbitrary File Retrieval http/cves/2019/CVE-2019-19985.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.