Login Request a demo
High severity · published Dec 3, 2018
CVE-2018-1002000
There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit
7.2
CVSS
4.4%
EPSS
No
On KEV
Description
There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit. There is an exploitable blind SQL injection vulnerability via the del_ids variable by POST request.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.4% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Arigato Autoresponder And Newsletter · Kibokolabs
2.5.1.8 · source: NVD
Affected product
AA
Arigato Autoresponder And Newsletter
Kibokolabs
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1002000
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1002000
Exploit
http://www.vapidlabs.com/advisory.php?v=203
Product
https://wordpress.org/plugins/bft-autoresponder/
Exploit
https://www.exploit-db.com/exploits/45434/
More from Arigato Autoresponder And Newsletter
9.8
CVE-2018-18461
The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code in attachments[] data…
8.8
CVE-2023-47686
WordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.2.2 is vulnerable to Cross Site Request Forgery (CSRF)
6.1
CVE-2023-25020
WordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.1.1 is vulnerable to Cross Site Scripting (XSS)
5.4
CVE-2023-25061
WordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.1.1 is vulnerable to Cross Site Scripting (XSS)
4.8
CVE-2023-25031
WordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)