CVE-2014-4725

The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code…

published July 27, 2014

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.1th percentile for exploit probability.

CVSS
—
EPSS
61%
Percentile
99.1
In the wild
Unconfirmed
What it is

The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.60656 · 99.1th percentile
Published
2014-07-27T18:00Z
EPSS history
Timeline
  • 27 JUL 18:00Z
    The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code…
    cvelistv5