Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline_edits] parameter. NOTE: exploitability depends on PHP objects that might be present with certain other plugins or themes.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
N/A
Vulnerability Title
WordPress Newsletter plugin 代码问题漏洞
Vulnerability Description
WordPress是WordPress（Wordpress）基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 Newsletter plugin before 6.8.2 for WordPress 存在安全漏洞，该漏洞源于不安全反序列化允许身份验证的远程攻击者可利用该漏洞拥有最小的特权(如订阅者)使用tpnc render AJAX动作通过options[inline editits]参数注入任意PHP对象。
CVSS Information
N/A
Vulnerability Type
N/A