CVE-2022-0439
Email Subscribers & Newsletters < 5.3.2 - Subscriber+ Blind SQL injection
- State
- Published
- Severity
- Not scored
- Published
- Mar 7, 2022
- Updated
- Aug 2, 2024
- Reserved
- Feb 1, 2022
Description
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Email Subscribers & NewslettersUnknown |
|
References
- https://wpscan.com/vulnerability/729d3e67-d081-4a4e-ac1e-f6b0a184f095exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.