CVE-2019-19982

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters versions prior to 4.2.3

Description The issue allows for unauthenticated option creation. To exploit this, an attacker would need to send a request to the "wp-admin/admin-post.php?es skip=1&option name=" endpoint.

Recommendations For versions prior to 4.2.3, update to version 4.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the /wp-admin/admin-post.php endpoint until the update is applied.