CVE-2024-8247: Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation
First published: Fri Sep 06 2024(Updated: )
The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2. This is due to the plugin not restricting what user meta can be updated as screen options. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator. Please note that this only affects users with access to edit/update screen options, which means an administrator would need to grant lower privilege users with access to the Sent & Draft Emails page of the plugin in order for this to be exploited.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tribulant Newsletters | <4.9.9.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2577102f-6355-4483-bd3d-1948497cb843?source=cve
- https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.9.9.1/wp-mailinglist.php#L3279
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3146287%40newsletters-lite&new=3146287%40newsletters-lite&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2024-8247?
CVE-2024-8247 is considered a privilege escalation vulnerability that can allow authenticated users to gain unauthorized permissions.
How do I fix CVE-2024-8247?
To fix CVE-2024-8247, update the Newsletters plugin for WordPress to version 4.9.9.3 or higher.
Who is affected by CVE-2024-8247?
CVE-2024-8247 affects all versions of the Newsletters plugin for WordPress up to and including 4.9.9.2.
What types of attacks can CVE-2024-8247 facilitate?
CVE-2024-8247 can facilitate attacks by allowing authenticated attackers to modify user meta data, potentially escalating their privileges.
What versions of the Newsletters plugin are impacted by CVE-2024-8247?
All versions of the Newsletters plugin for WordPress up to and including 4.9.9.2 are impacted by CVE-2024-8247.
- agent/title
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/severity
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/tags
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- vendor/tribulant
- canonical/tribulant newsletters