blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2018-1002000

HIGH 7.2 CVSS 3.0
Published
December 3, 2018
Last modified
June 17, 2026
NVD status
Modified
Reported by
larry0@me.com
Weakness
CWE-89
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit. There is an exploitable blind SQL injection vulnerability via the del_ids variable by POST request.

Affected WordPress components

  • Arigato Autoresponder and Newsletter Plugin · bft-autoresponder
    Confirmed match Active
    From unspecified (including) to 2.5.1.8 (including)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Kiboko Labs https://calendarscripts.info/ Arigato Autoresponder and Newsletter — From unspecified (including) to 2.5.1.8 (including)
  • kibokolabs arigato_autoresponder_and_newsletter — Version 2.5.1.8

References

  • www.vapidlabs.com http://www.vapidlabs.com/advisory.php?v=203 Exploit, Third Party Advisory
  • wordpress.org https://wordpress.org/plugins/bft-autoresponder/ Product
  • www.exploit-db.com https://www.exploit-db.com/exploits/45434/ Exploit, Third Party Advisory, VDB Entry
  • nvd.nist.gov Official NVD record