Threats tagged 'ghsa-j32g-r42g-5gh6'

The SendPress Newsletters plugin for WordPress up to version 1.26.1.20 is vulnerable to a time-based SQL Injection via the 'subscriberid' parameter. This vulnerability arises from insufficient escaping of user input and inadequate preparation of SQL queries, allowing unauthenticated attackers to inject additional SQL commands. The nonce intended to protect the handler uses a hardcoded action value that is publicly accessible, effectively bypassing nonce-based access control.