Description

The WordPress plugin "MailPoet Newsletters" (wysija-newsletters) before version 2.6.8 is vulnerable to an unauthenticated file upload. An attacker can use the Upload Theme functionality to upload a zip file containing a PHP shell.

Remediation

Upgrade to the latest version of MailPoet Newsletters (this issue was fixed in version 2.6.8).

References

MailPoet Newsletters Changelog

Remote File Upload Vulnerability in WordPress MailPoet Plugin (wysija-newsletters)

WordPress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload

Related Vulnerabilities

WordPress Plugin MapSVG Lite Arbitrary File Upload (4.0.5)

URL rewrite vulnerability

WordPress Plugin Product Catalog Arbitrary File Upload (3.8.6)

WordPress Plugin Web Tripwire Arbitrary File Upload (0.1.1)

WordPress Plugin WordPress File Upload Multiple Unspecified Vulnerabilities (3.10.0)

Severity

High

Classification

CWE-434 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Abuse Of Functionality Unauthenticated File Upload