Newsletters Email Marketing Sms And Popups By Omnisend
Monthly
Subscriber-level insecure direct object reference (IDOR) in the Omnisend WordPress plugin through version 1.9.0 allows an authenticated low-privilege user (Subscriber or higher) to modify certain objects they do not own. The flaw is rated CVSS 4.3 with a limited integrity-only impact, requires no user interaction, and can be reached remotely; no public exploit was identified at time of analysis. Sites running the plugin 1.9.0 or earlier with open registration are at higher practical risk because obtaining the required Subscriber account is trivial.
Subscriber-level insecure direct object reference (IDOR) in the Omnisend WordPress plugin through version 1.9.0 allows an authenticated low-privilege user (Subscriber or higher) to modify certain objects they do not own. The flaw is rated CVSS 4.3 with a limited integrity-only impact, requires no user interaction, and can be reached remotely; no public exploit was identified at time of analysis. Sites running the plugin 1.9.0 or earlier with open registration are at higher practical risk because obtaining the required Subscriber account is trivial.