CVE-2023-4797

HIGH

Newsletters < 4.9.3 - Authenticated Command Injection via SQL Query Parameters

Title source: llm

Description

The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.

References (1)

Core 1

Core References

Exploit, Third Party Advisory exploit vdb-entry technical-description

https://wpscan.com/vulnerability/de169fc7-f388-4abb-ab94-12522fd1ac92/

Scores

CVSS v3 7.2

EPSS 0.0096

EPSS Percentile 57.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-77

Status published

Products (1)

tribulant/newsletters < 4.9.3

Published Jan 16, 2024

Tracked Since Feb 18, 2026