CVE-2023-4797: Newsletter Lite < 4.9.3 - Admin+ Command Injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-16 · updated 2026-06-17
Weakness: CWE-77

Description

The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.

Affected products

contrid Newsletters: before 4.9.3 — fixed in 4.9.3

How to fix

Upgrade to a fixed version: contrid Newsletters 4.9.3. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/de169fc7-f388-4abb-ab94-12522fd1ac92/
https://wpscan.com/vulnerability/de169fc7-f388-4abb-ab94-12522fd1ac92/

Get alerted when CVE-2023-4797 or the next vulnerability affects your stack