WordPress Plugin Vulnerabilities

Email Subscribers & Newsletters < 3.4.8 - Unauthenticated Subscriber Download

Description

The Email Subscribers & Newsletters – Simple and Effective Email Marketing WordPress Plugin WordPress plugin was affected by an Unauthenticated Subscriber Download security vulnerability.

Proof of Concept

Affects Plugins

Plugin icon
email-subscribers
Fixed in 3.4.8

References

CVE
CVE-2018-6015
URL
https://www.tripwire.com/state-of-security/latest-security-news/wordpress-plugin-fixes-bug-allowing-download-of-100k-sites-subscriber-lists/
URL
https://blog.threatpress.com/vulnerability-email-subscribers-plugin/
URL
https://plugins.trac.wordpress.org/changeset/1805691/email-subscribers

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
7.5 (high)

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
8fc76721-45ef-4179-922c-ed5f5d59884f

Timeline

Publicly Published
2018-01-24 (about 8 years ago)
Added
2018-01-25 (about 8 years ago)
Last Updated
2020-08-07 (about 5 years ago)

Other

Published
Title
Published
2025-10-15
Title
Ace User Management <= 2.0.3 - Subscriber+ Authentication Bypass via Password Rest
Published
2016-06-06
Title
OneLogin SAML SSO <= 2.1.5 - Authentication Bypass
Published
2024-06-12
Title
Download Manager < 3.2.90 - Improper Authorization via protectMediaLibrary
Published
2014-08-01
Title
WordPress 3.7.1 & 3.8.1 - Potential Authentication Cookie Forgery
Published
2025-10-31
Title
Mstoreapp Mobile (App <= 2.08, Multivendor <= 9.0.1) - Unauthenticated Privilege Escalation