CVE-2020-35932

Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as…

High · published January 1, 2021

CVSS v3.1
7.5
EPSS
2%
Percentile
81.6
In the wild
Unconfirmed
What it is

Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline_edits] parameter. NOTE: exploitability depends on PHP objects that might be present with certain other plugins or themes.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.02108 · 81.6th percentile
Published
2021-01-01T01:24Z
EPSS history
Timeline
  • 01 JAN 01:24Z
    Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as…
    cvelistv5