CVE-2024-5674

Summary

CVE-2024-5674 is a vulnerability affecting the Newsletter - API v1 and v2 addon plugin for WordPress. The issue lies in the check_api_key function, which is susceptible to PHP type juggling. This flaw enables unauthenticated attackers to perform unauthorized subscribers management, including listing, creating, or deleting subscribers. The vulnerability affects WordPress sites using PHP versions below 8.0.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.