CVE-2021-24959: WP Email Users <= 1.7.6 - Subscriber+ SQL Injection
Published Mar 14, 2022
·Updated
The WP Email Users WordPress plugin through 1.7.6 does not escape the dataraw parameter in the weuselectedusers1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks.
Affected Software
1 affected component
Techspawn Wp-email-users Wordpress<=1.7.6
Event History
Mar 14, 2022
CVE Published
via MITRE·02:41 PM
Data Sourced
via MITRE·02:41 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-24959?
The severity of CVE-2021-24959 is high, with a CVSS score of 8.8.
2
Is the WP Email Users WordPress plugin version 1.7.6 affected by CVE-2021-24959?
Yes, the WP Email Users WordPress plugin version 1.7.6 is affected by CVE-2021-24959.
3
How can a SQL injection attack be performed in the WP Email Users plugin due to CVE-2021-24959?
A SQL injection attack can be performed by not escaping the data_raw parameter in the weu_selected_users_1 AJAX action, which is available to authenticated users.