CVE-2023-1844 — Subscribe2 <= 10.40 - Missing Authorization
The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capability check when sending test emails in versions up to, and…
Published: 2023-06-28 · CVSS: 4.3 · CVSS 3.1
The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capability check when sending test emails in versions up to, and including, 10.40. This makes it possible for author-level attackers to send emails with arbitrary content and attachments to site users.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7