CVE-2023-41735 MEDIUM

CVE-2023-41735: WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to Sensitive Data Exposure

Vendor Gopi Ramasamy
Product Email posts to subscribers
Weakness CWE-200 · Info exposure
Published November 30, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email posts to subscribers.This issue affects Email posts to subscribers: from n/a through 6.2.

Explanation of Vulnerability in Simple Terms

02Summary

Email posts to subscribers version 6.2 and earlier exposes sensitive information to unauthenticated attackers over the network. The vulnerability allows an attacker to read data that should be restricted, such as email addresses or post content intended only for subscribers. No user interaction or special privileges are required to exploit this flaw. Site administrators should update to a version newer than 6.2 as soon as a patch becomes available.

What an attacker can do

03Attacker Capabilities

Read sensitive information like email addresses or subscriber data without authentication.

Potential impact on your site

04Site Impact

Subscriber email addresses and potentially private post content may be exposed to anyone on the internet.

Conditions required to exploit

05Prerequisites

Network access only; no authentication, special privileges, or user interaction required.

Key dates

06Disclosure timeline

November 30, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-4126 Table Manager <= 1.0.0 - Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute CVE-2026-64874 Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension CVE-2026-3058 Seraphinite Accelerator <= 2.28.14 - Authenticated (Subscriber+) Exposure of Sensitive Information to an Unauthorized Actor CVE-2026-7542 Slider Revolution <= 7.0.10 - Authenticated (Subscriber+) Sensitive Information Disclosure CVE-2026-8995 Poll Maker by AYS <= 6.3.7 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays_poll_get_user_information' AJAX Action