Unauthorized Email Access in Subscribe2 Plugin for WordPress

CVE-2023-1844

Summary

The Subscribe2 plugin for WordPress suffers from an authorization bypass issue, allowing attackers with author-level access to send unauthorized emails to site users. This vulnerability arises from the absence of a capability check when sending test emails, which means that attackers can exploit this flaw to send emails containing arbitrary content and attachments. It's crucial for administrators using the Subscribe2 plugin to update to the latest version to mitigate the risk associated with this vulnerability.

References