CVE-2023-4797

Newsletter Lite < 4.9.3 - Admin+ Command Injection

High · published January 16, 2024

CVSS v3.1
7.2
EPSS
1%
Percentile
61.3
In the wild
Unconfirmed
What it is

The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00963 · 61.3th percentile
Published
2024-01-16T15:56Z
EPSS history
Timeline
  • 16 JAN 15:56Z
    Newsletter Lite < 4.9.3 - Admin+ Command Injection
    cvelistv5