The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress suffers from a missing capability check in the handle_ajax_request function in all versions up to 5.7.19. This missing authorization allows authenticated users with subscriber-level privileges or above to access and modify data without proper permissions. The flaw can result in unauthorized data access, modification, and deletion, impacting confidentiality, integrity, and availability. Additionally, the vulnerability could be leveraged to perform PHP Object Injection and SQL Injection attacks, increasing the risk of severe exploitation. The CVSS 3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Authenticated users with subscriber-level access or higher can exploit this vulnerability to bypass authorization controls, leading to unauthorized data disclosure, modification, and deletion. This compromises the confidentiality, integrity, and availability of the affected system's data. The vulnerability also opens avenues for advanced attacks such as PHP Object Injection and SQL Injection, which could further compromise the system's security posture.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to the plugin. Avoid granting unnecessary privileges to users and consider disabling the plugin if feasible until a patch is released.