Description
The WP Email Users WordPress plugin through 1.7.6 does not escape the data_raw parameter in the weu_selected_users_1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks.
Exploits (1)
nomisec
WORKING POC
1 stars
by RandomRobbieBF · poc
https://github.com/RandomRobbieBF/CVE-2021-24959
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/0471d2e2-e759-468f-becd-0b062f00b435
Scores
CVSS v3
8.8
EPSS
0.3942
EPSS Percentile
97.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (1)
techspawn/wp-email-users
< 1.7.6
Published
Mar 14, 2022
Tracked Since
Feb 18, 2026