CVE-2020-36727: Newsletter Manager <= 1.5.1 - Insecure Deserialization
The Newsletter Manager plugin for WordPress is vulnerable to insecure deserialization in versions up to, and including, 1.5.1. This is due to unsanitized input from the 'customFieldsDetails' parameter being passed through a deserialization function. This potentially makes it possible for unauthenticated attackers to inject a serialized PHP object.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36727?
CVE-2020-36727 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2020-36727?
To fix CVE-2020-36727, you should update the Newsletter Manager plugin to version 1.5.2 or later.
Who is affected by CVE-2020-36727?
CVE-2020-36727 affects users running the Newsletter Manager plugin for WordPress versions up to and including 1.5.1.
What type of vulnerability is CVE-2020-36727?
CVE-2020-36727 is an insecure deserialization vulnerability that arises from unsanitized input.
Can CVE-2020-36727 be exploited remotely?
Yes, CVE-2020-36727 can be exploited remotely, allowing an attacker to execute arbitrary code.