CVE-2023-4797

Newsletter Lite < 4.9.3 - Admin+ Command Injection

The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.

Affected

Newsletters

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.96% chance of exploitation in the next 30 days, 61st percentile

Published

2024-01-16

Updated

2025-06-11

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/de169fc7-f388-4abb-ab94-12522fd1ac92/

Security advisories

• https://wpscan.com/vulnerability/de169fc7-f388-4abb-ab94-12522fd1ac92

References

• CVE Record
• NVD entry