Description
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Wordpress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload
exploit/unix/webapp/wp_wysija_newsletters_upload
Exploit-DB 1
- WordPress Plugin MailPoet Newsletters 2.6.8 - 'wysija-newsletters' Arbitrary File Upload (Metasploit) EDB-33991 · remote · Jul 7, 2014 · verified
GitHub 1 repository
-
AnotherSec/CVE-2014-4725 ★ 2 · Aug 15, 2025
MailPoet Newsletters <= Arbitrary File Upload (exploiter)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://wordpress.org/plugins/wysija-newsletters/changelog/
- http://blog.sucuri.net/2014/07/remote-file-upload-vulnerability-on-mailpoet-wysija-newsletters.html
- http://blog.sucuri.net/2014/07/malware-infection-breaking-wordpress-sites.html
- http://arstechnica.com/security/2014/07/mass-exploit-of-wordpress-plugin-backdoors-sites-running-joomla-magento-too/
- [oss-security] 20140708 Re: CVE request: WordPress plugin wysija-newsletters remote file upload mailing-list
- http://blog.sucuri.net/2014/07/mailpoet-vulnerability-exploited-in-the-wild-breaking-thousands-of-wordpress-sites.html