WordPress plugin

Mail Masta security & vulnerabilities

Q: Is any Mail Masta vulnerability listed in CISA KEV?

No. None of the known Mail Masta vulnerabilities is currently listed in the CISA KEV catalog.

mail-masta— active installsLast vulnerability Mar 9, 2017

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin

14Known vulnerabilities

Critical2
High12
Medium0
Low0

Vulnerabilities per year

All Mail Masta vulnerabilities

Mail Masta vulnerabilities
Severity	Vulnerability	CVE	Published
High7.2	SQL Injection via subscriber_email parameter ≤1.0No patch available	CVE-2017-6578	Mar 9, 2017
High7.2	SQL Injection via id parameter ≤1.0No patch available	CVE-2017-6576	Mar 5, 2017
High7.2	SQL Injection via filter_list ≤1.0No patch available	CVE-2017-6574	Mar 5, 2017
High7.2	SQL Injection via filter_list parameter ≤1.0No patch available	CVE-2017-6096	Feb 18, 2017
High7.2	SQL Injection via camp_id parameter ≤1.0No patch available	CVE-2017-6097	Feb 18, 2017
High7.2	SQL Injection via id parameter ≤1.0No patch available	CVE-2017-6571	Feb 18, 2017
High7.2	SQL Injection via id parameter ≤1.0No patch available	CVE-2017-6573	Feb 18, 2017
Critical9.8	SQL Injection via list_id parameter ≤1.0No patch available	CVE-2017-6095	Feb 18, 2017
High7.2	SQL Injection via member_id parameter ≤1.0No patch available	CVE-2017-6575	Feb 18, 2017
High7.2	SQL Injection via filter_list parameter ≤1.0No patch available	CVE-2017-6572	Feb 18, 2017
High7.2	SQL Injection via list_id parameter ≤1.0No patch available	CVE-2017-6577	Feb 18, 2017
High7.2	SQL Injection via list_id parameter ≤1.0No patch available	CVE-2017-6098	Feb 18, 2017
High7.2	SQL Injection via id parameter ≤1.0No patch available	CVE-2017-6570	Feb 18, 2017
Critical9.8	Local File Inclusion ≤1.0No patch available	CVE-2016-10956	Aug 23, 2016

High7.2
SQL Injection via subscriber_email parameter
≤1.0No patch available
CVE-2017-6578Mar 9, 2017
High7.2
SQL Injection via id parameter
≤1.0No patch available
CVE-2017-6576Mar 5, 2017
High7.2
SQL Injection via filter_list
≤1.0No patch available
CVE-2017-6574Mar 5, 2017
High7.2
SQL Injection via filter_list parameter
≤1.0No patch available
CVE-2017-6096Feb 18, 2017
High7.2
SQL Injection via camp_id parameter
≤1.0No patch available
CVE-2017-6097Feb 18, 2017
High7.2
SQL Injection via id parameter
≤1.0No patch available
CVE-2017-6571Feb 18, 2017
High7.2
SQL Injection via id parameter
≤1.0No patch available
CVE-2017-6573Feb 18, 2017
Critical9.8
SQL Injection via list_id parameter
≤1.0No patch available
CVE-2017-6095Feb 18, 2017
High7.2
SQL Injection via member_id parameter
≤1.0No patch available
CVE-2017-6575Feb 18, 2017
High7.2
SQL Injection via filter_list parameter
≤1.0No patch available
CVE-2017-6572Feb 18, 2017
High7.2
SQL Injection via list_id parameter
≤1.0No patch available
CVE-2017-6577Feb 18, 2017
High7.2
SQL Injection via list_id parameter
≤1.0No patch available
CVE-2017-6098Feb 18, 2017
High7.2
SQL Injection via id parameter
≤1.0No patch available
CVE-2017-6570Feb 18, 2017
Critical9.8
Local File Inclusion
≤1.0No patch available
CVE-2016-10956Aug 23, 2016

Mail Masta: common questions

Does Mail Masta have known vulnerabilities?

Yes. VulnCrest Radar lists 14 known vulnerabilities in Mail Masta: 2 critical, 12 high. At least one is not fixed in the latest version.

How do I check which version of Mail Masta I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Mail Masta vulnerability?

CVE-2017-6578, published Mar 9, 2017: Mail Masta <= 1.0 - SQL Injection via subscriber_email parameter. Severity: High (CVSS 7.2).

Is any Mail Masta vulnerability listed in CISA KEV?

No. None of the known Mail Masta vulnerabilities is currently listed in the CISA KEV catalog.