CVE-2023-1844 MEDIUM

CVE-2023-1844: Subscribe2 <= 10.40 - Missing Authorization

Vendor Wedevs
Product Subscribe2 – Form, Email Subscribers & Newsletters
Weakness CWE-862 · Missing authorization
Published June 28, 2023
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capability check when sending test emails in versions up to, and including, 10.40. This makes it possible for author-level attackers to send emails with arbitrary content and attachments to site users.

Key dates

02Disclosure timeline

June 28, 2023 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-34976 Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization CVE-2025-58622 WordPress Mobile Contact Line Plugin <= 2.4.0 - Broken Access Control Vulnerability CVE-2025-30883 WordPress Trust.Reviews plugin <= 2.3 - Broken Access Control vulnerability CVE-2024-13651 RapidLoad – Optimize Web Vitals Automatically <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Limited Setting Reset CVE-2024-54289 WordPress Awesome Support plugin <= 6.3.1 - Broken Access Control vulnerability