Vulnerabilities / Ecomail
Ecomail vulnerabilities
Advisories WPSec published for Ecomail. Other sources may list more. Its attack surface: Ecomail on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-01 | WPSEC-2026-0161 | Ecomail <= 2.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Email Newsletter Subscription Changes via 'ecmid' Parameter | Medium 4.3 | 2.5.0 |
| 2026-10-01 | WPSEC-2026-0160 | Ecomail <= 2.4.3 - Cross-Site Request Forgery to Bulk Data Synchronization and List Refresh | Medium 4.3 | 2.5.0 |
| 2026-10-01 | WPSEC-2026-0159 | Ecomail <= 2.4.3 - Authenticated (Contributor+) Missing Authorization to Bulk Data Synchronization and List Refresh | Medium 4.3 | 2.5.0 |
| 2026-10-01 | WPSEC-2026-0158 | Ecomail <= 2.4.3 - Unauthenticated Missing Authorization to Arbitrary Cart Tracking Events via 'email' Parameter | Medium 5.3 | 2.5.0 |
| 2026-10-01 | WPSEC-2026-0157 | Ecomail <= 2.4.3 - Missing Authorization to Subscription Status Modification via Webhook REST Endpoint | Medium 6.5 | 2.5.0 |
License: CC BY 4.0