CVE-2017-6572
HighSummary
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue is present in the ./inc/lists/add_member.php file with the GET Parameter: filter_list.
Risk Assessment
An attacker with admin access can exploit this vulnerability to gain unauthorized access to the database, potentially leading to the disclosure of sensitive information or data modification.
Recommendation
It is recommended to update the Mail Masta plugin to the latest version to mitigate this vulnerability. Additionally, access to the admin panel should be restricted to trusted users only.
Other vulnerabilities in Mail Masta plugin 1.0 for WordPress
See all- CVE-2017-6578High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue affects the ./inc/subscriber_list.php file and the POST parameter: subscriber_email.
- CVE-2017-6577High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue affects the ./inc/subscriber_list.php file and the POST Parameter: list_id.
- CVE-2017-6576High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue affects the file ./inc/campaign/campaign-delete.php and the GET parameter: id.
- CVE-2017-6575High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue is present in the ./inc/lists/edit_member.php file with the GET Parameter: member_id.
- CVE-2017-6574High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue exists in the ./inc/lists/edit_member.php file with the GET Parameter: filter_list.
- CVE-2017-6573High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue is present in the ./inc/lists/edit-list.php file with the GET Parameter: id.
- CVE-2017-6571High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue is present in the ./inc/campaign/view-campaign.php file with the GET Parameter: id.
- CVE-2017-6570High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue is present in the ./inc/campaign/view-campaign-list.php file with the GET Parameter: id.
- CVE-2017-6097High
The Mail Masta plugin (also known as mail-masta) version 1.0 for WordPress has a SQL injection issue. This issue affects the /inc/campaign/count_of_send.php file and requires authentication to the WordPress admin panel, using the POST parameter: camp_id.
- CVE-2017-6095Critical
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability in the /inc/lists/csvexport.php file. This issue affects unauthenticated access using the GET parameter: list_id.
Original NVD description (English source)
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/lists/add_member.php with the GET Parameter: filter_list.