Email Subscribers Plugin Vulnerable to Data Theft and Loss

CVE-2024-4010

Summary

The Email Subscribers plugin by Icegram Express for WordPress has been identified as vulnerable due to a missing capability check in its handle_ajax_request function. This oversight allows authenticated users, including those with subscriber-level access, to perform unauthorized actions that compromise the confidentiality, integrity, and availability of sensitive data. Attackers can exploit this vulnerability to execute unauthorized modifications and potentially leverage it for PHP Object Injection and SQL Injection attacks, leading to severe implications for website security and user data protection.

References