Unauthorized Access to Sensitive Data in Email Subscribers Plugin

CVE-2024-8771

Summary

The Email Subscribers by Icegram Express, a popular email marketing and automation plugin for WordPress and WooCommerce, has a vulnerability that allows unauthorized access to sensitive data. This issue arises from a missing capability check on the 'preview_email_template_design' function, impacting all versions up to and including 5.7.34. As a result, authenticated attackers with Subscriber-level access and above can exploit this flaw to extract sensitive information, including content from private, password-protected, pending, and draft posts and pages. Website owners should ensure they are using the latest version of the plugin to mitigate this risk and protect their data from potential breaches.

References