CVE-2014-4939

ENL Newsletter <= 1.0.1 - Authenticated (Admin+) SQL Injection

highImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

7.2

CVSS Score

7.2

CVSS Score

high

Severity

Unpatched

Patched in

N/A

Time to patch

Description

SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

High

Confidentiality

High

Integrity

High

Availability

Technical Details

Affected versions<=1.0.1

PublishedMay 28, 2014

Last updatedJanuary 22, 2024

Affected pluginenl-newsletter

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/419270e7-c781-41fe-9893-473074825b36?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database