The Email Subscribers & Newsletters is a WordPress newsletter plugin used to send post notifications, send broadcasts. It can be integrated with Mailchimp and the plugin has more than 100,000+ active installs.
Wordfence Threat Intelligence team has discovered multiple vulnerabilities in the plugin that allows attackers to launch various attacks targeting vulnerable installations.
The plugin has an option to export all the subscribers into a single CSV file that contains the details provided by subscribers such as first names, last names, email addresses, mailing lists.
These details can be downloaded only by the server admin, there is a flaw in plugin version 4.2.2 which allows unauthenticated users to export the data.
The vulnerability received CVSS v3.0 Score: 5.8(Medium) and fixed with version 4.2.3.
The plugin has functionality tracked ‘open’ actions to check for several users opening the email, but there is a flaw in the plugin which allows “SQL statements to be passed to the database in the hash parameter creating a blind SQL injection vulnerability,” reads Wordfence blog post.
The vulnerability received CVSS v3.0 Score: 8.3(high) and it has been fixed with version 4.3.1.
With the admin dashboard, the Email Subscribers & Newsletter plugin contains options such as settings, audience information, campaign information, forms, and more.
These options can be accessed by any user with the permission edit_post, the contributor user, WordPress themes and plugins have this option.
The vulnerability received CVSS v3.0 Score: 6.3(Medium) and it has been fixed with version 4.2.3.
The plugin has no nonce checks to see whether the request coming from the admin session, this allows attackers to modify settings via CSRF.
The vulnerability received CVSS v3.0 Score: 6.3(Medium) and it has been fixed with version 4.2.3.
The plugin contains options to send the test to verify the configurations, unfortunately, there is a vulnerability with the plugin that allows unauthenticated users to send the test mails.
The vulnerability received CVSS v3.0 Score: 4.3(Medium) and it has been fixed with version 4.2.3.
The Email Subscribers & Newsletters plugin has an onboarding option that can be skipped after installation, if it is skipped then “it creates a new option in the database and saves the value as yes.”
“Unfortunately, there was no access control for this feature so any unauthenticated user could create this option in the database, which could be appended with any value.”
The vulnerabilities were reported to the developer team by Wordfence on October 14th, 2019, on October 23rd, 2019 initial patch was released and a final patch released on November 13th, 2019. Users are recommended to update with the latest version 4.3.1.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates
The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…
White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…
Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…
The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…
Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…
WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…