Vulnerability · Published Jun 7, 2023 · Assigned by Wordfence

CVE-2020-36727Newsletter Manager <= 1.5.1 - Insecure Deserialization

Critical 9.8

In plain English

A critical-severity unsafe deserialization in Newsletter Manager from f1logic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.6%top 23.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Newsletter Manager plugin for WordPress is vulnerable to insecure deserialization in versions up to, and including, 1.5.1. This is due to unsanitized input from the 'customFieldsDetails' parameter being passed through a deserialization function. This potentially makes it possible for unauthenticated attackers to inject a serialized PHP object.

Affected products (as reported)

Vendor	Product	Versions
f1logic	Newsletter Manager	0 – through 1.5.1

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References