Email previews accessible even when not published

I have found that all newsletters are accessible even if they haven’t been published.

Once you know a site uses MailPoet all that you have to do is change the email_id in the url structure below and view any of the newsletters setup.

http://www.example.com/?wysija-page=1&controller=email&action=view&email_id=7&wysijap=subscriptions

https://wordpress.org/plugins/wysija-newsletters/