CVE-2020-5780: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2020-5780) affects the Email Subscribers & Newsletters plugin by Icegram for WordPress versions prior to 4.5.6. This high-severity flaw was discovered in September 2020 and impacts more than 100,000 WordPress websites. The vulnerability allows remote, unauthenticated attackers to conduct email forgery and spoofing attacks (Tenable Advisory, Threatpost).

The vulnerability exists in the class-es-newsletters.php class and stems from a missing authentication mechanism for critical functions. The flaw received a CVSS v3.1 base score of 7.5 (High), with a vector string of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The issue allows unauthenticated users to send ajax requests to the admin_init hook, which triggers the process_broadcast_submission function without proper authentication checks (Tenable Advisory).

An attacker can exploit this vulnerability to send forged emails to all recipients from the available lists of contacts or subscribers, with complete control over the email content and subject. Since the emails would come from a trusted source, recipients are more likely to trust the communication, making it an effective vector for phishing attacks or scams (Threatpost).

The vulnerability can be exploited by sending a crafted ajax request to create a new broadcast and schedule a greeting email with modified content. The attack requires no authentication and can be executed remotely. As of the disclosure, there were no known instances of this vulnerability being exploited in the wild (Tenable Advisory).

Users must upgrade to WordPress Email Subscribers & Newsletters plugin version 4.5.6 or higher to remediate this vulnerability. The patch was released on September 9, 2020, following responsible disclosure by the researchers (Tenable Advisory).