Description
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Newsletters | < 4.18.1 | 4.18.1 |
References
- https://wpscan.com/vulnerability/0dd1de2d-e9bb-4c42-a78b-2643d43dfed6/ exploit vdb-entry technical-description