CVE-2014-4939: SQL Injection

Published Jul 11, 2014

Updated

SQL injection vulnerability in the ENL Newsletter (enl-newsletter) plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php.

Affected Software

1 affected component

Enl Newsletter Plugin Project Enl-newsletter Wordpress=1.0.1

Event History

Jul 11, 2014

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-4939?

CVE-2014-4939 has a medium severity rating due to its potential for remote SQL injection attacks.

How do I fix CVE-2014-4939?

To fix CVE-2014-4939, update the ENL Newsletter plugin to the latest version or remove it if no longer needed.

What impact does CVE-2014-4939 have on my WordPress site?

CVE-2014-4939 allows authenticated remote administrators to execute arbitrary SQL commands, potentially compromising database security.

Who is affected by CVE-2014-4939?

CVE-2014-4939 affects users of the ENL Newsletter plugin version 1.0.1 for WordPress.

What is the primary vulnerability exploited in CVE-2014-4939?

The primary vulnerability in CVE-2014-4939 is a SQL injection flaw in the handling of the 'id' parameter.