CVE-2014-4725

The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote...

7.5 HighPublic exploit

The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.

Exploit likelihood

60.7%Up 51.4 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2014-4725
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-287
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-4725
Updated: 2026-11-02

EUVDEUVD-2014-4644 No score

Record: EUVD-2014-4644
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xgmx-rr3c-2xgc No score

The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote...

Record: GHSA-xgmx-rr3c-2xgc
Weakness: CWE-287
Updated: 2026-11-02

Affected products

mailpoet newsletters

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	WordPress Plugin MailPoet Newsletters 2.6.8 - 'wysija-newsletters' Arbitrary File Upload (Metasploit)	2014-07-07
Metasploit	Wordpress MailPoet Newsletters (wysija-newsletters) Unauthenticated File Upload	2014-07-01
PoC in GitHub	AnotherSec/CVE-2014-4725	2025-08-15

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-4725 is a high vulnerability (CVSS 7.5) in Mailpoet Newsletters, published July 27, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 60.7%, the 99th percentile. No source names a fixed version.