Read the docs
TI-2023-04414 Aliases CVE-2023-4797GHSA-hjjv-gwf3-fpj2

Newsletter Lite < 4.9.3 - Admin+ Command Injection

Priority HIGH 67CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-77.

Summary

The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00963 61st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Newsletters (Unknown): 4.9.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownNewslettersbefore 4.9.34.9.3Patch availableCNA
  • Newsletters VendorUnknown Affected before 4.9.3 Fixed in 4.9.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tribulant:newsletters:*:*:*:*:*:wordpress:*:*before 4.9.3Vulnerablecontrid
  • cpe:2.3:a:tribulant:newsletters:*:*:*:*:*:wordpress:*:* Versions before 4.9.3 Vulnerable ·contrid

Remediation

  • Fix · CNA Newsletters (Unknown) Fixed in 4.9.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-4797
  2. 2026-10-03 Alias added: GHSA-hjjv-gwf3-fpj2

References

Exploit 1

  • TI-2018-14949 The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection. CVSS 3.0CRITICAL 9.8
  • TI-2019-10994 wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters… CVSS 3.1HIGH 8.8
  • TI-2024-07645 Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation CVSS 3.1HIGH 8.8
  • TI-2023-14314 WordPress Newsletters Plugin <= 4.8.8 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2024-24742 WordPress Newsletters plugin <= 4.9.7 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
  • TI-2025-04349 Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion CVSS 3.1HIGH 7.2
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences