PT-2018-14476 · Arigato · Arigato Autoresponder/Newsletter

Published 2018-10-18 · Updated 2018-11-30 · CVE-2018-18461

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arigato Autoresponder and Newsletter plugin version 2.5.1.7

Description The issue allows remote attackers to execute arbitrary code by injecting PHP code into the attachments[] data sent to the models/attachment.php file. This enables attackers to perform unauthorized actions on the system.

Recommendations For version 2.5.1.7, consider disabling the models/attachment.php file or restricting access to it until a patch is available to prevent exploitation.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2018-18461

Affected Products

Arigato Autoresponder/Newsletter

References · 4

• 🔥 https://github.com/rakjong/vuln/blob/master/woedpress-Arigato%20Autoresponder_and_Newsletter-getshell.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2018-18461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18461 · Security Note
• https://wordpress.org/plugins/bft-autoresponder/#developers · Note