medium5.3Public exploit code
CVE-2019-19985
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Email Subscribers & Newsletters 4.2.2 - Unauthenticated File Download2020-07-26 · webapps · php
Impact
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Icegram | Email Subscribers \& Newsletters | before 4.2.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/158563/WordPress-Email-Subscribers-And-Newsletters-4.2.2-File-Disclosure.html
- https://wpvulndb.com/vulnerabilities/9946
- https://www.wordfence.com/blog/2019/11/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin/
- http://packetstormsecurity.com/files/158563/WordPress-Email-Subscribers-And-Newsletters-4.2.2-File-Disclosure.html
- https://wpvulndb.com/vulnerabilities/9946
- https://www.wordfence.com/blog/2019/11/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin/