Vulnerability · Published Jun 14, 2021 · Assigned by WPScan
CVE-2021-24345Sendit WP Newsletter <= 2.5.1 - Authenticated (admin+) SQL Injection
Medium 6.6
In plain English
A medium-severity SQL injection in Sendit WP Newsletter from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS NVD)6.6Medium
Exploit odds (30 days)1.3%top 28.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Sendit WP Newsletter | 2.5.1 – through 2.5.1 |
Weakness: CWE-89
References
- https://wpscan.com/vulnerability/02ba4d8b-f4d2-42cd-9fae-b543e112fa04 x_refsource_CONFIRM
- https://codevigilant.com/disclosure/2021/wp-plugin-sendit/ x_refsource_MISC