Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2014-4725
HistoryJul 27, 2014 - 6:55 p.m.

CVE-2014-4725

2014-07-2718:55:05
CWE-287
[email protected]
web.nvd.nist.gov
95
mailpoet newsletters
wordpress
remote attackers
php code execution
authentication bypass
cve-2014-4725
nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.9 High

AI Score

Confidence

Low

0.296 Low

EPSS

Percentile

97.0%

JSON

The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.

Affected configurations

NVD
Node
mailpoetmailpoet_newslettersRange≤2.6.6wordpress
OR
mailpoetmailpoet_newslettersMatch0.9wordpress
OR
mailpoetmailpoet_newslettersMatch0.9.1wordpress
OR
mailpoetmailpoet_newslettersMatch0.9.2wordpress
OR
mailpoetmailpoet_newslettersMatch0.9.6wordpress
OR
mailpoetmailpoet_newslettersMatch1.0wordpress
OR
mailpoetmailpoet_newslettersMatch1.0.1wordpress
OR
mailpoetmailpoet_newslettersMatch1.1wordpress
OR
mailpoetmailpoet_newslettersMatch1.1.1wordpress
OR
mailpoetmailpoet_newslettersMatch1.1.2wordpress
OR
mailpoetmailpoet_newslettersMatch1.1.3wordpress
OR
mailpoetmailpoet_newslettersMatch1.1.4wordpress
OR
mailpoetmailpoet_newslettersMatch1.1.5wordpress
OR
mailpoetmailpoet_newslettersMatch2.0wordpress
OR
mailpoetmailpoet_newslettersMatch2.0.1wordpress
OR
mailpoetmailpoet_newslettersMatch2.0.2wordpress
OR
mailpoetmailpoet_newslettersMatch2.0.3wordpress
OR
mailpoetmailpoet_newslettersMatch2.0.4wordpress
OR
mailpoetmailpoet_newslettersMatch2.0.5wordpress
OR
mailpoetmailpoet_newslettersMatch2.0.6wordpress
OR
mailpoetmailpoet_newslettersMatch2.0.7wordpress
OR
mailpoetmailpoet_newslettersMatch2.0.8wordpress
OR
mailpoetmailpoet_newslettersMatch2.0.9wordpress
OR
mailpoetmailpoet_newslettersMatch2.0.9.5wordpress
OR
mailpoetmailpoet_newslettersMatch2.1wordpress
OR
mailpoetmailpoet_newslettersMatch2.1.1wordpress
OR
mailpoetmailpoet_newslettersMatch2.1.2wordpress
OR
mailpoetmailpoet_newslettersMatch2.1.3wordpress
OR
mailpoetmailpoet_newslettersMatch2.1.4wordpress
OR
mailpoetmailpoet_newslettersMatch2.1.5wordpress
OR
mailpoetmailpoet_newslettersMatch2.1.6wordpress
OR
mailpoetmailpoet_newslettersMatch2.1.7wordpress
OR
mailpoetmailpoet_newslettersMatch2.1.8wordpress
OR
mailpoetmailpoet_newslettersMatch2.1.9wordpress
OR
mailpoetmailpoet_newslettersMatch2.2wordpress
OR
mailpoetmailpoet_newslettersMatch2.2.1wordpress
OR
mailpoetmailpoet_newslettersMatch2.2.2wordpress
OR
mailpoetmailpoet_newslettersMatch2.2.3wordpress
OR
mailpoetmailpoet_newslettersMatch2.3wordpress
OR
mailpoetmailpoet_newslettersMatch2.3.1wordpress
OR
mailpoetmailpoet_newslettersMatch2.3.2wordpress
OR
mailpoetmailpoet_newslettersMatch2.3.3wordpress
OR
mailpoetmailpoet_newslettersMatch2.3.4wordpress
OR
mailpoetmailpoet_newslettersMatch2.3.5wordpress
OR
mailpoetmailpoet_newslettersMatch2.4wordpress
OR
mailpoetmailpoet_newslettersMatch2.4.1wordpress
OR
mailpoetmailpoet_newslettersMatch2.4.2wordpress
OR
mailpoetmailpoet_newslettersMatch2.4.3wordpress
OR
mailpoetmailpoet_newslettersMatch2.4.4wordpress
OR
mailpoetmailpoet_newslettersMatch2.5wordpress
OR
mailpoetmailpoet_newslettersMatch2.5.1wordpress
OR
mailpoetmailpoet_newslettersMatch2.5.2wordpress
OR
mailpoetmailpoet_newslettersMatch2.5.3wordpress
OR
mailpoetmailpoet_newslettersMatch2.5.4wordpress
OR
mailpoetmailpoet_newslettersMatch2.5.5wordpress
OR
mailpoetmailpoet_newslettersMatch2.5.7wordpress
OR
mailpoetmailpoet_newslettersMatch2.5.8wordpress
OR
mailpoetmailpoet_newslettersMatch2.5.9wordpress
OR
mailpoetmailpoet_newslettersMatch2.5.9.1wordpress
OR
mailpoetmailpoet_newslettersMatch2.5.9.2wordpress
OR
mailpoetmailpoet_newslettersMatch2.5.9.3wordpress
OR
mailpoetmailpoet_newslettersMatch2.5.9.4wordpress
OR
mailpoetmailpoet_newslettersMatch2.6wordpress
OR
mailpoetmailpoet_newslettersMatch2.6betawordpress
OR
mailpoetmailpoet_newslettersMatch2.6.1wordpress
OR
mailpoetmailpoet_newslettersMatch2.6.2wordpress
OR
mailpoetmailpoet_newslettersMatch2.6.3wordpress
OR
mailpoetmailpoet_newslettersMatch2.6.4wordpress
OR
mailpoetmailpoet_newslettersMatch2.6.5wordpress

Related

checkpoint_advisories 1
patchstack 1
nvd 1
cvelist 1
openvas 1
dsquare 1
prion 1
nessus 1
checkpoint_advisories
checkpoint_advisories
WordPress MailPoet Newsletters Unauthenticated File Upload (CVE-2014-4725)
2014-08-11 00:00:00
patchstack
patchstack
WordPress MailPoet (Wysija NewsLetters) plugin - Unauthenticated File Upload
2014-07-07 00:00:00
nvd
nvd
CVE-2014-4725
2014-07-27 18:55:05
cvelist
cvelist
CVE-2014-4725
2014-07-27 18:00:00
openvas
openvas
WordPress MailPoet Newsletters Plugin Remote File Upload Vulnerability
2014-07-28 00:00:00
dsquare
dsquare
WordPress MailPoet Newsletters File Upload
2014-09-01 00:00:00
prion
prion
Authentication flaw
2014-07-27 18:55:00
nessus
nessus
MailPoet Newsletters for WordPress Arbitrary File Upload
2014-07-16 00:00:00

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.9 High

AI Score

Confidence

Low

0.296 Low

EPSS

Percentile

97.0%

JSON
Related for CVE-2014-4725
checkpoint_advisories1patchstack1nvd1cvelist1openvas1dsquare1prion1nessus1