Collected research

Remote File Upload Vulnerability in WordPress MailPoet Plugin (wysija-newsletters)

The WordPress MailPoet plugin assumed the admin_init hook only fires for logged-in administrators, but any request to admin-post.php runs it too. That left the theme upload path reachable without authentication, so anyone could upload an arbitrary PHP file to the site and execute code on it.

Record

Published by

Sucuri Blog

Date

1 July 2014

Topic

Server

In the archive

• Collected in the 2014 research round

Tags

• file-upload
• auth-bypass
• rce
• wordpress
• php
• vendor-advisory
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Sucuri Blog, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.