What the vulnerability does
01Description
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.34. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Explanation of Vulnerability in Simple Terms
02Summary
The Email Subscribers & Newsletters plugin for WordPress versions 5.7.34 and earlier contains a code injection vulnerability. An authenticated user with low privileges can inject and execute arbitrary PHP code through an unvalidated input field. This allows attackers to modify site content, steal data, or compromise the WordPress installation. Update to a version newer than 5.7.34 immediately.
What an attacker can do
03Attacker Capabilities
Inject and execute arbitrary PHP code on the site to read data or modify content.
Potential impact on your site
04Site Impact
Attackers with basic WordPress accounts can run malicious code, potentially stealing data or defacing your site.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress account (subscriber or above) and network access.
Key dates
06Disclosure timeline
October 2, 2024
CVE published
April 8, 2026
Record updated
