Newsletters

Newsletters: The CVSS vector permits an unauthenticated attacker. Attacker-controlled serialized data can reach unsafe deserialization and instantiate PHP objects. The source rates confidentiality, integrity and availability impacts as high. A usable gadget chain and a particular code-execution path are not established in the export. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 4.18.1.

Newsletters: The CVSS vector permits an unauthenticated attacker. Attacker-controlled input can alter an inadequately neutralized SQL query. The source rates confidentiality impact as high and availability impact as limited, with no integrity impact; database write access or operating-system command execution is not established. The authoritative export does not name the vulnerable endpoint, request action, parameter or implementation function. Published affected versions: <= 4.18.1.

Newsletters through 4.18 has an SQL-injection flaw requiring Administrator access according to the CNA description. The disclosed class is attacker-influenced input being interpreted as part of an SQL command; the export does not identify the input parameter, endpoint, handler, query or encoding, so the exact path cannot be established. The CNA vector indicates high confidentiality impact and limited availability impact, without user interaction; it does not establish database modification or operating-system code execution. The affected-version data marks 4.18.1 unaffected.

Newsletters before 4.17 saves one settings screen without a nonce or capability check and writes every submitted parameter into plugin options. An attacker can make a logged-in Administrator overwrite arbitrary Newsletters settings, including the credential protecting its API, through a cross-site request.

Newsletters before 4.17 derives its API key from a publicly known value instead of a sufficiently random source. When the optional API is enabled, an unauthenticated attacker can compute the key and perform privileged operations such as adding or deleting subscribers and sending email.

Newsletters through 4.17 lets an Author or higher forge newsletters_mailinglistsroles during a normal post submission. The attacker-controlled role slug is passed to get_users(), allowing arbitrary newsletter email to be sent to any WordPress role, including Administrators, through the site's own outbound mail channel.

Newsletters before 4.16 uses loose equality in wpMailAPI::api_init() to compare a client-supplied api_key with the configured key. When the optional API is enabled, an unauthenticated request to /wp-admin/admin-ajax.php?action=newsletters_api can supply a non-string JSON value that PHP considers equal under type juggling, then choose api_method and api_data. Exposed methods include subscriber_add, subscriber_delete, send_email and send_newsletter, allowing subscriber-record changes and email or newsletter sending without the real key. The exact bypass value is not disclosed, and any configured API host allowlist remains an additional prerequisite. Version 4.16 requires non-empty strings and validates them with hash_equals().

Newsletters before 4.16 treats a request value for a public subscribe-form field of type pre_date as serialized data. render_field() reads the field's dynamic slug from the request and passes the value to maybe_unserialize(), causing PHP to instantiate a submitted object while rendering the form. Practical impact depends on a compatible POP or gadget chain already present in WordPress, the plugin, the theme or another plugin; no usable chain is disclosed, so code execution or destructive impact is not confirmed. The exact form URL and parameter vary by site configuration. Version 4.16 does not unserialize request-sourced date values and disallows classes when formatting stored serialized values.

Newsletters Lite through 4.15 lets an authenticated Contributor supply a malicious link attribute to the post_thumbnail or newsletters_post_thumbnail shortcode. The shortcode dispatcher passes the attributes to post_thumbnail(), which concatenates the attacker-controlled link directly into an anchor href without esc_url() or esc_attr(). Rendering the stored shortcode therefore turns the value into executable page markup and can run script in visitors' browsers. This content-rendering path does not use a separate plugin endpoint, action or request parameter.

Newsletters Lite through 4.15 lets an authenticated Contributor place an attribute-breakout payload in the target attribute of a newsletters_post shortcode. posts_single() propagates that shortcode attribute into the global wpml_target value, and the post_thumbnail branch of shortcode_posts() concatenates it directly into an anchor target HTML attribute without esc_attr(). Rendering the stored shortcode can therefore execute attacker-controlled script in visitors' browsers. This content-rendering path does not use a separate plugin endpoint, action or request parameter.

Newsletters is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 4.14.

Newsletters is affected by broken access control. Exposure depends on how the affected operation is made reachable by the site. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 4.13.

Newsletters is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 4.13.

Newsletters is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.13.

Newsletters is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Newsletters is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Newsletters is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Newsletters is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Newsletters is affected by filesystem traversal. Exploitation requires an authenticated administrator account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Newsletters is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data.

Newsletters is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Newsletters is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Newsletters is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Newsletters is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Newsletters is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Newsletters is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Newsletters is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess.

Newsletters is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Newsletters is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

Newsletters is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Newsletters is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Newsletters is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

Newsletters is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Newsletters Lite is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Newsletters Lite is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

Newsletters Lite is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

Newsletters Lite is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.