CVE-2020-36727

Published Jun 7, 2023

Last updated a year ago

CVSS critical 9.8

Overview

Description: The Newsletter Manager plugin for WordPress is vulnerable to insecure deserialization in versions up to, and including, 1.5.1. This is due to unsanitized input from the 'customFieldsDetails' parameter being passed through a deserialization function. This potentially makes it possible for unauthenticated attackers to inject a serialized PHP object.
Source: security@wordfence.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

nvd@nist.gov: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:xyzscripts:newsletter_manager:*:*:-:*:-:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D4EC2450-3FC8-4397-8975-F8D1CED71276",
            "versionEndIncluding": "1.5.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References