Vulnerability record · CVE-2014-4725 · published 27 July 2014
CVE-2014-4725: MailPoet Newsletters plugin auth bypass leads to PHP code execution
Mailpoet · Mailpoet Newsletters
The MailPoet Newsletters (wysija-newsletters) WordPress plugin before 2.6.7 allows remote attackers to bypass authentication and upload a crafted theme via wp-admin/admin-post.php, then execute arbitrary PHP by accessing the uploaded theme under wp-content/uploads/wysija/themes/mailp/. Because the uploaded file is reachable and executed as PHP, a successful attack yields full code execution on the WordPress host.
Description
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
critical priorityUnauthenticated remote code execution with documented in-the-wild mass exploitation and very high EPSS.
What it is
The MailPoet Newsletters (wysija-newsletters) WordPress plugin before 2.6.7 allows remote attackers to bypass authentication and upload a crafted theme via wp-admin/admin-post.php, then execute arbitrary PHP by accessing the uploaded theme under wp-content/uploads/wysija/themes/mailp/. Because the uploaded file is reachable and executed as PHP, a successful attack yields full code execution on the WordPress host.
Impact
An unauthenticated remote attacker can run arbitrary PHP code on the web server, enabling backdoors, data theft, or full site compromise.
Attack surface
Reached over the network through wp-admin/admin-post.php and the uploads theme path; the CVSS vector (AV:N/AC:L/Au:N) and description indicate no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV, but references are tagged Exploit and describe mass exploitation in the wild, and EPSS is 0.59948 (99.09th percentile), indicating high likelihood of exploitation.
What to do
- Update the wysija-newsletters plugin to 2.6.7 or later immediately.
- If patching is not possible, disable or remove the plugin until it can be updated.
- Block or restrict access to wp-admin/admin-post.php and the wp-content/uploads/wysija/themes/ path at the web server or WAF.
- Scan the site for webshells and unexpected PHP files under wp-content/uploads/ and remove any found.
- Rotate WordPress admin credentials and review for unauthorized accounts or content changes.
Detection
- Monitor web logs for POST requests to wp-admin/admin-post.php followed by GET requests to wp-content/uploads/wysija/themes/mailp/.
- Alert on PHP files appearing under wp-content/uploads/ or wp-content/uploads/wysija/themes/.
- Scan the filesystem for recently modified or newly created PHP files in upload directories.
- Review WordPress plugin inventory for wysija-newsletters versions below 2.6.7.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-4725 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-4725), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
