CVE-2014-4939 ENL Newsletter <= 1.0.1 - Authenticated (Admin+) SQL Injection
MediumCVSS 6.5
EPSS 2.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| enl newsletter plugin project enl-newsletter | = 1.0.1 | No fix listed |
| wordpress enl-newsletter(WordPress) | <= 1.0.1 | No fix listed |
References
- codevigilant.com exploit
- Wordfence Intelligence third-party-advisory
- www.cve.org