CVE-2022-0439: Email Subscribers & Newsletters < 5.3.2 - Subscriber+ Blind SQL injection
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-0439?
CVE-2022-0439 is a vulnerability in the Email Subscribers & Newsletters WordPress plugin that allows blind SQL injection attacks by low-privileged users.
What is the severity of CVE-2022-0439?
CVE-2022-0439 has a severity score of 8.8, classified as high.
How does CVE-2022-0439 affect the Email Subscribers & Newsletters plugin?
CVE-2022-0439 affects the Email Subscribers & Newsletters plugin before version 5.3.2 by not correctly escaping the `order` and `orderby` parameters to the `ajax_fetch_report_list` action.
Who can perform blind SQL injection attacks using CVE-2022-0439?
Users with roles as low as Subscriber can perform blind SQL injection attacks using CVE-2022-0439.
Is there a fix for CVE-2022-0439?
Yes, the fix for CVE-2022-0439 is to upgrade the Email Subscribers & Newsletters plugin to version 5.3.2 or higher.