PT-2026-108747 · WordPress · Sendpress Newsletters
CVSS v3.1
5.3
متوسطة
| المتجه | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
SendPress Newsletters WordPress plugin versions prior to 1.26.1.21
Description
The plugin uses a hardcoded token that is identical across all installations to protect a logging endpoint. Because this token is not a per-site secret, unauthenticated users can access the endpoint to read newsletter sending logs, which may expose recipient email addresses.
Recommendations
Update the SendPress Newsletters WordPress plugin to version 1.26.1.21 or later.
استغلال
إصلاح
Information Disclosure
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Sendpress Newsletters