CVE-2017-6578
HighSummary
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue affects the ./inc/subscriber_list.php file and the POST parameter: subscriber_email.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to the database, jeopardizing the integrity and confidentiality of data within the organization.
Recommendation
It is recommended to update the Mail Masta plugin to the latest version to mitigate this vulnerability and restrict admin panel access to trusted users.
Other vulnerabilities in Mail Masta plugin 1.0 for WordPress
See all- CVE-2017-6577High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue affects the ./inc/subscriber_list.php file and the POST Parameter: list_id.
- CVE-2017-6576High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue affects the file ./inc/campaign/campaign-delete.php and the GET parameter: id.
- CVE-2017-6575High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue is present in the ./inc/lists/edit_member.php file with the GET Parameter: member_id.
- CVE-2017-6574High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue exists in the ./inc/lists/edit_member.php file with the GET Parameter: filter_list.
- CVE-2017-6573High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue is present in the ./inc/lists/edit-list.php file with the GET Parameter: id.
- CVE-2017-6572High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue is present in the ./inc/lists/add_member.php file with the GET Parameter: filter_list.
- CVE-2017-6571High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue is present in the ./inc/campaign/view-campaign.php file with the GET Parameter: id.
- CVE-2017-6570High
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability that can be exploited by users with admin access. The issue is present in the ./inc/campaign/view-campaign-list.php file with the GET Parameter: id.
- CVE-2017-6097High
The Mail Masta plugin (also known as mail-masta) version 1.0 for WordPress has a SQL injection issue. This issue affects the /inc/campaign/count_of_send.php file and requires authentication to the WordPress admin panel, using the POST parameter: camp_id.
- CVE-2017-6095Critical
The Mail Masta plugin version 1.0 for WordPress has a SQL injection vulnerability in the /inc/lists/csvexport.php file. This issue affects unauthenticated access using the GET parameter: list_id.
Original NVD description (English source)
A SQL injection issue is exploitable, with WordPress admin access, in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects ./inc/subscriber_list.php with the POST Parameter: subscriber_email.