CVE-2023-4797 - Newsletter Lite < 4.9.3 - Admin+ Command Injection

Back Back to CVE browser

HIGH

Newsletter Lite < 4.9.3 - Admin+ Command Injection

Published Jan 16, 2024

7.2

HIGH

CVSS 3.1

EPSS 0.96%

Description

The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.

Affected products

Vendor n/a Product Newsletters Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <4.9.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Newsletters

unaffected

Version	Status	Constraints
0	affected	<4.9.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-77

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54641
Advisory
https://wpscan.com/vulnerability/de169fc7-f388-4abb-ab94-12522fd1ac92/
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54641		Advisory
https://wpscan.com/vulnerability/de169fc7-f388-4abb-ab94-12522fd1ac92/		exploitvdb-entrytechnical-descriptionThird Party Advisory