WordPress Plugin Vulnerabilities
Email Subscribers & Newsletters < 4.2.3 - Multiple Issues
Description
- Unauthenticated File Download leading to Information Disclosure
- Blind SQL Injection in INSERT statement
- Insecure Permissions on Dashboard and Settings
- CSRF on Settings
- Send Test Emails from the Administrative Dashboard as an Authenticated User (with a role of Subscriber and above)
- Unauthenticated Option Creation
Affects Plugins
Fixed in 4.2.3 References
Miscellaneous
Verified
No
WPVDB ID
Timeline
Publicly Published
2019-11-13 (about 6 years ago)
Added
2019-11-13 (about 6 years ago)
Last Updated
2020-08-08 (about 5 years ago)
WPScan 