Unauthenticated Subscription Status Change in Email Subscribers & Newsletters WordPress Plugin

Executive Summary

This vulnerability affects the Email Subscribers by Icegram Express WordPress plugin before version 5.9.35. It allows unauthenticated users to change a subscriber's status without proper authorization by exploiting a missing token verification mechanism. Attackers can force-unsubscribe or force-confirm any subscriber if they know the subscriber's email address.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the 'Email Subscribers by Icegram Express' plugin version prior to 5.9.35. You can verify the plugin version via the WordPress admin dashboard under Plugins or by inspecting the plugin files on the server.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to manipulate subscriber lists by forcing unsubscriptions or confirmations without consent. For website owners, this may disrupt email campaigns, reduce engagement, or lead to loss of trust among subscribers. Users relying on the plugin for email marketing could face operational disruptions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may impact compliance with GDPR and other privacy regulations by enabling unauthorized changes to subscriber consent status. For GDPR, this could violate requirements for explicit consent and data subject rights. For HIPAA, if used in healthcare contexts, it may compromise protected health information integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the 'Email Subscribers by Icegram Express' plugin to version 5.9.35 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review subscriber lists for unauthorized changes and monitor for suspicious activity.

Useful 0 Not Useful 0