{"uuid": "9fb6a867-d35a-439f-b507-53d804112f8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2014-4725", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_wysija_newsletters_upload.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"Marc-Alexandre Montpas\", \"Christian Mehlmauer \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"The Wordpress plugin \\\"MailPoet Newsletters\\\" (wysija-newsletters) before 2.6.8\\n          is vulnerable to an unauthenticated file upload. The exploit uses the Upload Theme\\n          functionality to upload a zip file containing the payload. The plugin uses the\\n          admin_init hook, which is also executed for unauthenticated users when accessing\\n          a specific URL. The first fix for this vulnerability appeared in version 2.6.7,\\n          but the fix can be bypassed. In PHP's default configuration,\\n          a POST variable overwrites a GET variable in the $_REQUEST array. The plugin\\n          uses $_REQUEST to check for access rights. By setting the POST parameter to\\n          something not beginning with 'wysija_', the check is bypassed. Wordpress uses\\n          the $_GET array to determine the page, so it is not affected by this. The developers\\n          applied the fixes to all previous versions too.\", \"disclosure_date\": \"2014-07-01\", \"fullname\": \"exploit/unix/webapp/wp_wysija_newsletters_upload\", \"is_install_path\": true, \"mod_time\": \"2025-10-06 17:15:11 +0000\", \"name\": \"Wordpress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/unix/webapp/wp_wysija_newsletters_upload.rb\", \"platform\": \"PHP\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"unix/webapp/wp_wysija_newsletters_upload\", \"references\": [\"CVE-2014-4725\", \"URL-http://blog.sucuri.net/2014/07/remote-file-upload-vulnerability-on-mailpoet-wysija-newsletters.html\", \"URL-http://www.mailpoet.com/security-update-part-2/\", \"URL-https://plugins.trac.wordpress.org/changeset/943427/wysija-newsletters/trunk/helpers/back.php\", \"WPVDB-6680\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"wysija-newsletters < 2.6.8\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:52.507143Z"}