Description

The WordPress plugin "MailPoet Newsletters" (wysija-newsletters) before version 2.6.8 is vulnerable to an unauthenticated file upload. An attacker can use the Upload Theme functionality to upload a zip file containing a PHP shell.

Remediation

Upgrade to the latest version of MailPoet Newsletters (this issue was fixed in version 2.6.8).

References

MailPoet Newsletters Changelog

Remote File Upload Vulnerability in WordPress MailPoet Plugin (wysija-newsletters)

WordPress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload

Related Vulnerabilities

WordPress Plugin Kino Gallery TimThumb Arbitrary File Upload (1.0)

WordPress Plugin WP User Frontend-Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission Arbitrary File Upload (2.3.10)

WordPress Plugin SpamTask Arbitrary File Upload (1.3.6)

WordPress Plugin Uploadify Remote File Upload (1.0)

WordPress Plugin user files Arbitrary File Upload (2.4.2)

Severity

High

Classification

CWE-434 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Abuse Of Functionality Unauthenticated File Upload