Threats tagged 'ghsa-92x8-ggpg-wv3x'

The Newsletters plugin for WordPress up to version 4.18.1 is vulnerable to a time-based SQL Injection via the 'id' parameter. This vulnerability arises from insufficient escaping and lack of proper preparation of the SQL query involving user-supplied input. Authenticated attackers with subscriber-level access or higher can exploit this flaw to append additional SQL queries and extract sensitive database information. Attackers can obtain necessary authentication tokens without a WordPress account by subscribing through the public newsletter form and using the management link sent via email. The ownership check only verifies the subscriber_id field and does not confirm that the injected 'id' parameter belongs to the authenticated subscriber.