| Package | Affected versions | Patched versions |
|---|---|---|
| email subscribers & newsletters | < 3.4.8 | 3.4.8 |
An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at the end, and adding option=view_all_subscribers in the body, allows downloading of a CSV data file with all subscriber data.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free