Description
WordPress Plugin Email Artillery (MASS EMAIL) is prone to multiple vulnerabilities, including cross-site scripting, arbitrary file upload and SQL injection vulnerabilities. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, to steal cookie-based authentication credentials, to upload arbitrary code and run it in the context of the webserver process, which may facilitate unauthorized access or privilege escalation, or to compromise the application, access or modify data or to exploit vulnerabilities in the underlying database. WordPress Plugin Email Artillery (MASS EMAIL) version 4.1 is vulnerable; prior versions may also be affected.
Remediation
Disable and remove the plugin until a fix is available
References
https://sploitus.com/exploit?id=WPEX-ID:A4EFF186-2308-491C-B82D-1D6B7BE79727
https://sploitus.com/exploit?id=WPEX-ID:4EA0127E-AFEF-41BF-A005-C57432F9F58C
https://sploitus.com/exploit?id=WPEX-ID:7A4DE4CD-7D42-43F4-BAA5-FAC1C9457A55
https://sploitus.com/exploit?id=WPEX-ID:35E1E5DD-5AA5-4481-B7ED-2DDF00A08986