title: Newsletter Lite < 4.9.3 - Admin+ Command Injection
description: The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.
problem types: CWE-78 OS Command Injection
affected:
{
vendor: Unknown
product: Newsletters
versions:
status: affected, versionType: semver, version: 0, lessThan: 4.9.3
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}