WordPress MailPoet Newsletters Unauthenticated File Upload (CVE-2014-4725)

An arbitrary file upload vulnerability exists in the WordPress plug-in MailPoet Newsletters. The vulnerability is due to lack of access control validation. A remote unauthenticated attacker could exploit this vulnerability by sending specially crafted request to the server...

CVE-2014-4725

The MailPoet Newsletters (wysija-newsletters) plugin for WordPress is vulnerable to an unauthenticated remote file upload in versions before 2.6.8 . The root cause is a failure to properly validate access control when using the admin_init hook. Specifically, the plugin used the $_REQUEST array to...