CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in Icegram Email Subscribers & Newsletters email-subscribers allows Object Injection.This issue affects Email Subscribers & Newsletters: from n/a through <= 5.9.10.
Explanation of Vulnerability in Simple Terms
Email Subscribers & Newsletters versions 5.9.10 and earlier contain a deserialization vulnerability in how they process untrusted data. An authenticated administrator can exploit this to read sensitive site data, modify content, or disrupt service. The vulnerability requires high-level admin access and does not involve user interaction.
What an attacker can do
Read sensitive data, modify site content, or disrupt service by submitting malicious serialized data.
Potential impact on your site
A compromised admin account can be used to extract data, alter posts/settings, or crash the site.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
