CVE-2019-14788

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-08-15 · updated 2026-06-17
Weakness: CWE-22

Description

wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value.

Affected products

contrid Newsletters: before 4.6.19 — fixed in 4.6.19

How to fix

Upgrade to a fixed version: contrid Newsletters 4.6.19. Check the vendor advisory for mitigations.

References

https://wordpress.org/plugins/newsletters-lite/#developers
https://wpvulndb.com/vulnerabilities/9447
https://www.pluginvulnerabilities.com/2019/07/02/there-is-also-an-authenticated-remote-code-execution-rce-vulnerability-in-newsletters/
https://wordpress.org/plugins/newsletters-lite/#developers
https://wpvulndb.com/vulnerabilities/9447
https://www.pluginvulnerabilities.com/2019/07/02/there-is-also-an-authenticated-remote-code-execution-rce-vulnerability-in-newsletters/

Get alerted when CVE-2019-14788 or the next vulnerability affects your stack