CVE-2019-14788: Path Traversal

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2019-14788.

Q: What is the title of this vulnerability?

The title of this vulnerability is 'wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before…'.

Q: What is the severity of CVE-2019-14788?

The severity of CVE-2019-14788 is high.

Q: How does CVE-2019-14788 allow remote PHP code execution?

CVE-2019-14788 allows remote PHP code execution through directory traversal and manipulation of the 'subscribers[1][1]' and 'exportfile' parameters.

Q: How can I fix CVE-2019-14788?

To fix CVE-2019-14788, you should update the Tribulant Newsletters plugin to version 4.6.19 or later.

Published Aug 15, 2019

Updated

wp-admin/admin-ajax.php?action=newslettersexportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value.

Affected Software

1 affected component

Tribulant Newsletters Wordpress<4.6.19

Event History

Aug 15, 2019

CVE Published

via MITRE·03:45 PM

Data Sourced

via MITRE·03:45 PM

Description

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2019-14788.

What is the title of this vulnerability?

The title of this vulnerability is 'wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before…'.

What is the severity of CVE-2019-14788?

The severity of CVE-2019-14788 is high.

How does CVE-2019-14788 allow remote PHP code execution?

CVE-2019-14788 allows remote PHP code execution through directory traversal and manipulation of the 'subscribers[1][1]' and 'exportfile' parameters.

How can I fix CVE-2019-14788?