CVE-2020-35932
High
Description
Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline_edits] parameter. NOTE: exploitability depends on PHP objects that might be present with certain other plugins or themes.
SeverityHigh
CVSS7.5
Exploit probability—
ProductTribulant Newsletter
PublishedJan 1, 2021
First seenJan 1, 2021
How to fix
Update
- tribulant newsletter6.8.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tribulant newsletter | v < 6.8.2 | 6.8.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.