PT-2014-5596

Name of the Vulnerable Software and Affected Versions MailPoet Newsletters wysija-newsletters plugin versions prior to 2.6.11 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of arbitrary users. Recommendations For versions prior to 2.6.11,...

JVN#94409737: MailPoet Newsletters vulnerable to cross-site request forgery

MailPoet Newsletters is a plugin for WordPress. MailPoet Newsletters contains a cross-site request forgery vulnerability. Impact If a user views a malicious page while logged in, unintended operations may be conducted. Solution Update the Software Update to the latest version according to the...

CVE-2014-3907: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the MailPoet Newsletters wysija-newsletters plugin before 2.6.11 for WordPress allows remote attackers to hijack the authentication of arbitrary users...

WordPress plug-in MailPoet memory vulnerabilities or cause the website to be black-and-vulnerability warning-the black bar safety net

7 in early May, according to security company Sucuri research report, downloaded over 1 7 0 million WordPress plug-in MailPoet was traced to the presence of security risks, may result in the site more likely to be a hacker hijacked, according to its indicates, is black the website is still growin...

WordPress MailPoet Newsletters Unauthenticated File Upload (CVE-2014-4725)

An arbitrary file upload vulnerability exists in the WordPress plug-in MailPoet Newsletters. The vulnerability is due to lack of access control validation. A remote unauthenticated attacker could exploit this vulnerability by sending specially crafted request to the server...

WordPress MailPoet Newsletters Plugin Remote File Upload Vulnerability

WordPress MailPoet Plugin is prone to remote file upload vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2014-4725

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

CVE-2014-4726

Unspecified vulnerability in the MailPoet Newsletters wysija-newsletters plugin before 2.6.8 for WordPress has unspecified impact and attack vectors...

Design/Logic Flaw

Unspecified vulnerability in the MailPoet Newsletters wysija-newsletters plugin before 2.6.8 for WordPress has unspecified impact and attack vectors...

Authentication flaw

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

CVE-2014-4725

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

CVE-2014-4726

CVE-2014-4726 concerns the WordPress MailPoet Newsletters (wysija-newsletters) plugin, affected through versions prior to 2.6.8. The available connected documents confirm an unspecified vulnerability in this plugin with undefined impact and attack vectors; no concrete exploitation details are pro...

CVE-2014-4726

Unspecified vulnerability in the MailPoet Newsletters wysija-newsletters plugin before 2.6.8 for WordPress has unspecified impact and attack vectors...

CVE-2014-4726

Unspecified vulnerability in the MailPoet Newsletters wysija-newsletters plugin before 2.6.8 for WordPress has unspecified impact and attack vectors...

CVE-2014-4725

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

CVE-2014-4725

The MailPoet Newsletters (wysija-newsletters) plugin for WordPress is vulnerable to an unauthenticated remote file upload in versions before 2.6.8 . The root cause is a failure to properly validate access control when using the admin_init hook. Specifically, the plugin used the $_REQUEST array to...

PT-2014-6078

Name of the Vulnerable Software and Affected Versions MailPoet Newsletters wysija-newsletters plugin versions prior to 2.6.8 Description The issue concerns an unspecified vulnerability in the MailPoet Newsletters plugin for WordPress. The impact and attack vectors of this vulnerability are not...

PT-2014-6077

Name of the Vulnerable Software and Affected Versions MailPoet Newsletters wysija-newsletters plugin versions prior to 2.6.7 Description The issue allows remote attackers to bypass authentication and execute arbitrary PHP code. This is achieved by uploading a crafted theme using the...

CVE-2014-4726: Undefined Security Weakness

Unspecified vulnerability in the MailPoet Newsletters wysija-newsletters plugin before 2.6.8 for WordPress has unspecified impact and attack vectors...

CVE-2014-4725: Improper Authentication

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...