CVE-2023-4797 Newsletter Lite < 4.9.3 - Admin+ Command Injection
Administrators can execute arbitrary commands on the server due to improper escaping of user-controlled parameters in the Newsletter Lite plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4797?
CVE-2023-4797 is a high-severity command injection vulnerability in Unknown Newsletters, published on 16 Jan 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.
Weakness: CWE-77
Which versions are affected by CVE-2023-4797?
It affects 1 product.
Products include Tribulant Newsletters.
How do I fix CVE-2023-4797?
No fix has been published for CVE-2023-4797 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-4797 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4797 exists.
Other vulnerabilities in Unknown Newsletters
- CVE-2018-20987 Deserialization in n/a
- CVE-2024-8247 Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation
- CVE-2019-14788 Path traversal in n/a
- CVE-2025-4857 Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion
- CVE-2024-35718 WordPress Newsletters plugin <= 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability
Sources
Also known as GHSA-hjjv-gwf3-fpj2.