Unauthorized Subscribers Management Vulnerability in The Newsletter API Plugin for WordPress

CVE-2024-5674

6.5MEDIUM

Key Information

Vendor: The Newsletter
Status: Newsletter
Vendor: CVE Published:; 12 June 2024

Summary

The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the check_api_key function in all versions up to, and including, 2.4.5. This makes it possible for unauthenticated attackers to list, create or delete newsletter subscribers. This issue affects only sites running the PHP version below 8.0

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Jun 12, 2024

Collectors

NVD Database