Evil-DB LogoEvil-DB
← All CVEs

CVE-2014-4725

high · 7.5

The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.

7.5
CVSS
59.9%
EPSS (exploit prob.)
99th
EPSS percentile
2014-07-27
Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-287

Affected products

VendorProductAffected versions
mailpoetmailpoet_newsletters<= 2.6.6
mailpoetmailpoet_newsletters0.9
mailpoetmailpoet_newsletters0.9.1
mailpoetmailpoet_newsletters0.9.2
mailpoetmailpoet_newsletters0.9.6
mailpoetmailpoet_newsletters1.0
mailpoetmailpoet_newsletters1.0.1
mailpoetmailpoet_newsletters1.1
mailpoetmailpoet_newsletters1.1.1
mailpoetmailpoet_newsletters1.1.2
mailpoetmailpoet_newsletters1.1.3
mailpoetmailpoet_newsletters1.1.4
mailpoetmailpoet_newsletters1.1.5
mailpoetmailpoet_newsletters2.0
mailpoetmailpoet_newsletters2.0.1
mailpoetmailpoet_newsletters2.0.2
mailpoetmailpoet_newsletters2.0.3
mailpoetmailpoet_newsletters2.0.4
mailpoetmailpoet_newsletters2.0.5
mailpoetmailpoet_newsletters2.0.6
mailpoetmailpoet_newsletters2.0.7
mailpoetmailpoet_newsletters2.0.8
mailpoetmailpoet_newsletters2.0.9
mailpoetmailpoet_newsletters2.0.9.5
mailpoetmailpoet_newsletters2.1
mailpoetmailpoet_newsletters2.1.1
mailpoetmailpoet_newsletters2.1.2
mailpoetmailpoet_newsletters2.1.3
mailpoetmailpoet_newsletters2.1.4
mailpoetmailpoet_newsletters2.1.5
mailpoetmailpoet_newsletters2.1.6
mailpoetmailpoet_newsletters2.1.7
mailpoetmailpoet_newsletters2.1.8
mailpoetmailpoet_newsletters2.1.9
mailpoetmailpoet_newsletters2.2
mailpoetmailpoet_newsletters2.2.1
mailpoetmailpoet_newsletters2.2.2
mailpoetmailpoet_newsletters2.2.3
mailpoetmailpoet_newsletters2.3
mailpoetmailpoet_newsletters2.3.1

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-4725