CVE-2024-8771

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'preview_email_template_design' function in all versions up to, and including, 5.7.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the content of private, password protected, pending, and draft posts and pages.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
icegram	Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress	<= 5.7.34

References

Timeline

Published: Sep 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-87724.351l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition CVE-2024-87738.3SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vul CVE-2024-87747.7The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges t CVE-2024-87755.5A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a CVE-2024-87766.1SmartRobot from INTUMIT does not properly validate a specific page parameter, allowing unautheticated remote attackers to inject JavaScript CVE-2024-87777.5OMFLOW from The SYSCOM Group has an information leakage vulnerability, allowing unauthorized remote attackers to read arbitrary system confi CVE-2024-87786.5OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular pri CVE-2024-87798.8OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers CVE-2024-87806.5OMFLOW from The SYSCOM Group does not properly restrict the query range of its data query functionality, allowing remote attackers with regu CVE-2024-87818.7Execution with Unnecessary Privileges, : Improper Protection of Alternate Path vulnerability in TR7 Application Security Platform (ASP) allo CVE-2024-87829.8A vulnerability was found in JFinalCMS up to 1.0. It has been rated as critical. This issue affects the function delete of the file /admin/t CVE-2024-87835.4A vulnerability classified as problematic has been found in OpenTibiaBR MyAAC up to 0.8.16. Affected is an unknown function of the file syst