WordPress Newsletter Plugin Missing Authorization Arbitrary Modification (CVE-2024-2825)

Vulnerability Overview Vulnerability Name: Newsletter <= 6.17 - Missing Authorization to Authenticated (Author's) Arbitrary Modification via Newsletter_mailinggroup PDF Parameters Vulnerability Type: Authorization Bypass Release Date: 2024-03-25 CVE ID: CVE-2024-2825 CVSS Score: 7.5 (High) Affected Scope Affected Software: Newsletter Affected Versions: <= 6.17 Affected Platform: WordPress Affected Component: Newsletter_mailinggroup PDF Parameters Remediation Remediation Status: Fixed Fixed Version: 6.18 Fix Release Date: 2024-03-25 Vulnerability Details Vulnerability Description: This vulnerability allows authenticated users (authors) to perform unauthorized modifications to arbitrary mailing lists via Newsletter_mailinggroup PDF parameters. Exploitation: Attackers can exploit this vulnerability to modify mailing lists, potentially leading to information leakage or data tampering. Related Vulnerabilities CVE-2024-2824: Newsletter <= 6.17 - Stored XSS via Newsletter_mailinggroup PDF Parameters CVE-2024-2823: Newsletter <= 6.17 - Stored XSS via Newsletter_mailinggroup PDF Parameters CVE-2024-2822: Newsletter <= 6.17 - Stored XSS via Newsletter_mailinggroup PDF Parameters CVE-2024-2821: Newsletter <= 6.17 - Stored XSS via Newsletter_mailinggroup PDF Parameters CVE-2024-2820: Newsletter <= 6.17 - Stored XSS via Newsletter_mailinggroup PDF Parameters References Wordfence Intelligence CVE-2024-2825 Code Blocks No Proof of Concept (POC) or exploitation code was included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Newsletter Plugin Missing Authorization Arbitrary Modification (CVE-2024-2825)

More from this source