CVE-2019-19985

CVE-2019-19985 describes an unauthenticated file download vulnerability in the WordPress plugin, Email Subscribers & Newsletters, versions prior to 4.2.3. This flaw allows an attacker to retrieve arbitrary files, potentially disclosing sensitive user information. With a CVSS score of 5.3 (Medium) and an EPSS score indicating high exploitability, the vulnerability is easily exploitable over the network without requiring user interaction or privileges, leading to a potential loss of confidentiality. While not listed in CISA's KEV catalog, public exploit code is available via ExploitDB and Nuclei templates, though there is no evidence of active exploitation or significant community discussion.