CVE-2019-19985: WordPress Email Subscribers plugin unauthenticated file download

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote information disclosure with a public exploit and very high EPSS, though impact is limited to confidentiality.

What it is

Email Subscribers & Newsletters before 4.2.3 contains a missing authorization flaw (CWE-862) that lets an unauthenticated visitor download files, exposing user information. The plugin is widely deployed on WordPress sites, so any unpatched install is directly reachable from the internet.

Impact

An attacker can retrieve files containing subscriber or user data without logging in, giving them personal information useful for spam, phishing or further targeting.

Attack surface

Reachable over the network via HTTP against the WordPress plugin endpoint; the CVSS vector shows no privileges and no user interaction required, so any anonymous visitor can attempt it.

Exploitation

Not listed in CISA KEV and no ransomware association, but EPSS is very high (0.714, 99.4th percentile) and a public exploit write-up is referenced, indicating active interest and easy exploitation.

What to do

• Update Email Subscribers & Newsletters to 4.2.3 or later immediately.
• If patching is delayed, disable or remove the plugin until it can be updated.
• Restrict access to plugin files and directories via web server rules where feasible.
• Review WordPress plugin inventory regularly and remove unused plugins.
• Monitor vendor advisories for follow-up fixes to the same plugin.

Detection

• Search web access logs for requests to Email Subscribers plugin file paths returning 200 responses from unauthenticated clients.
• Alert on unusual download patterns or bulk requests to plugin directories.
• Check installed plugin versions against 4.2.3 and flag older ones.
• Correlate outbound traffic or data exfiltration indicators with plugin endpoint access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.