Vulnerability feed

Executive summary

A deserialization flaw in the Newsletters WordPress plugin by Tribulant Software lets unauthenticated attackers run harmful code on affected websites. The advisory rates it 9.8 out of 10 severity and says it is expected to be exploited in mass attack campaigns. The recommended action is to update the plugin to version 4.18.2 or later.

Technical summary

The flaw is a PHP Object Injection caused by deserialization of untrusted data, classified as OWASP A3 Injection. The advisory states it requires no privileges (unauthenticated) and gives a CVSS severity of 9.8, with the affected range listed as through 4.18.1 and the patched version as 4.18.2. The advisory describes the attack vector only in general terms and does not give the specific vulnerable parameter or request. Workarounds are not stated beyond a Patchstack mitigation rule that blocks attacks, and the vendor's own fix is updating to 4.18.2 or later. No detection guidance, indicators of compromise, or confirmation of active exploitation in the wild is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

Tribulant SoftwareTribulant Software Newsletters

Executive summary

A SQL injection flaw affects the Newsletters plugin for WordPress, made by Tribulant Software, in versions 4.18.1 and earlier. The publisher rates it 9.3 on CVSS and says it is highly dangerous and likely to be used in mass-exploit campaigns, so the advisory recommends updating the plugin to version 4.18.2 or later right away.

Technical summary

This is an SQL injection vulnerability (OWASP A3: Injection) in the Newsletters WordPress plugin, versions 4.18.1 and earlier, with a CVSS severity of 9.3 and a Patchstack priority of High. The advisory states that it can be exploited by an unauthenticated attacker, and that successful exploitation could let an attacker read, modify, or delete the entire database, including user accounts and private data. The patched version is 4.18.2, and the advisory says to update to 4.18.2 or later. Patchstack has issued a mitigation rule that blocks attacks until the site is updated. The advisory does not state any other workarounds, and it does not give specific detection guidance or indicate whether exploitation has been observed in the wild beyond saying it is expected to become exploited.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Changed

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Affects

Tribulant SoftwarePatchstackTribulant Software Newsletters