Medium severity4.3NVD Advisory· Published Sep 26, 2024· Updated Jun 17, 2026

CVE-2024-8771

Description

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'preview_email_template_design' function in all versions up to, and including, 5.7.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the content of private, password protected, pending, and draft posts and pages.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Email Subscribers by Icegram Expressllm-fuzzy2 versions
<=5.7.34+ 1 more
- (no CPE)range: <=5.7.34
- (no CPE)
Icegram/Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPresscpe-rescue
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3157336/nvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/f9d90717-fd48-493b-9293-32976bf2cadanvdThird Party Advisory
plugins.trac.wordpress.org/browser/email-subscribers/trunk/lite/admin/class-email-subscribers-admin.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000