The Email Subscribers by Icegram Express plugin for WordPress contains a missing capability check in the 'preview_email_template_design' function. This flaw permits authenticated users with Subscriber-level privileges or above to bypass intended access controls and retrieve sensitive data such as private, password-protected, pending, and draft content. The vulnerability is identified as CWE-862 (Missing Authorization) and affects all versions up to 5.7.34. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges but no user interaction. No known exploits in the wild or vendor patches are documented in the provided data.

An attacker with at least Subscriber-level access can access sensitive content that should be restricted, including private and draft posts and pages. This leads to unauthorized disclosure of potentially confidential information. The vulnerability does not impact data integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to email template previews. Avoid granting unnecessary privileges to users. Follow updates from Icegram for any released patches or official mitigations.