PT-2025-50756 · WordPress · Fof Pretty Mail

Published 2025-12-11 · Updated 2025-12-12 · CVE-2024-58303

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FoF Pretty Mail version 1.1.2

Description The software contains a server-side template injection issue that allows administrative users to inject malicious code into email templates. An attacker can execute system commands by inserting crafted template expressions that trigger arbitrary code execution during email generation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2024-58303

GHSA-947Q-2XW3-GX9C

Affected Products

Fof Pretty Mail

References · 8

• 🔥 https://exploit-db.com/exploits/51948 · Exploit
• https://osv.dev/vulnerability/CVE-2024-58303 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58303 · Security Note
• https://github.com/FriendsOfFlarum/pretty-mail · Note
• https://vulncheck.com/advisories/fof-pretty-mail-server-side-template-injection-via-email-template-settings · Note
• https://t.me/CVEtracker/39534 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1999293860942319689 · Twitter Post
• https://flarum.org · Note