Vulnerability in privilege checking
The plugin did not sufficiently check whether a page was actually visited by the website administratory. This vulnerability gives a potential intruder the power to do anything he wants on his victim’s website and allows for any PHP file to be uploaded.
http://blog.sucuri.net/2014/07/remote-file-upload-vulnerability-on-mailpoet-wysija-newsletters.html
This vulnerability affects the following application versions:
- MailPoet 2.1
- MailPoet 2.1.1
- MailPoet 2.1.2
- MailPoet 2.1.3
- MailPoet 2.1.4
- MailPoet 2.1.5
- MailPoet 2.1.6
- MailPoet 2.1.7
- MailPoet 2.1.8
- MailPoet 2.1.9
- MailPoet 2.2
- MailPoet 2.2.1
- MailPoet 2.2.2
- MailPoet 2.2.3
- MailPoet 2.3
- MailPoet 2.3.1
- MailPoet 2.3.2
- MailPoet 2.3.3
- MailPoet 2.3.4
- MailPoet 2.3.5
- MailPoet 2.4
- MailPoet 2.4.1
- MailPoet 2.4.2
- MailPoet 2.4.3
- MailPoet 2.4.4
- MailPoet 2.5
- MailPoet 2.5.1
- MailPoet 2.5.2
- MailPoet 2.5.3
- MailPoet 2.5.4
- MailPoet 2.5.5
- MailPoet 2.5.7
- MailPoet 2.5.8
- MailPoet 2.5.9
- MailPoet 2.5.9.1
- MailPoet 2.5.9.2
- MailPoet 2.5.9.3
- MailPoet 2.5.9.4
- MailPoet 2.6
- MailPoet 2.6.1
- MailPoet 2.6.2
- MailPoet 2.6.3
- MailPoet 2.6.4
- MailPoet 2.6.5
- MailPoet 2.6.6
- MailPoet 2.6.7