CVE-2014-4725

High

Published: 27/07/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

The MailPoet Newsletters (wysija-newsletters) plugin before version 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme.

Risk Assessment

Attackers can gain access to the system and execute malicious code, potentially leading to full control over the website or data leakage.

Recommendation

It is recommended to update the plugin to the latest version to mitigate this vulnerability and to monitor the system for unauthorized changes.

Other vulnerabilities in MailPoet Newsletters (wysija-newsletters) plugin for WordPress

CVE-2014-4726High
An unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before version 2.6.8 for WordPress may lead to unspecified impact and attack vectors.

Original NVD description (English source)

The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.