CVE-2008-0683 ShiftThis (Unspecified Version) - SQL Injection

HighCVSS 7.5 EPSS 2.6% Public exploit

Published: 2008-02-12 17:00 (approximate time: when CVE Radar first recorded it)
Updated: 2026-06-17 01:50
Exploit status: Public exploit available

Description

SQL injection vulnerability in shiftthis-preview.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter.

Affected products

Product	Affected versions	Fixed in
wordpress st newsletter plugin	All versions	No fix listed
wordpress st_newsletter(WordPress)	All versions	No fix listed

References

27586 exploit vdb-entry
5053 exploit
Wordfence Intelligence third-party-advisory
www.cve.org

CVSS v2.0

7.5 High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

All scores (2)

v3.1 9.8 · wordfence
v2.0 7.5 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 2.56% (percentile 85.3)
CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

WordPress Plugin st_newsletter - SQL Injection Exploit · Exploit Database (OffSec) · 2008-02-03