CVE-2023-4797 is a high severity (CVSS 7.2) command injection in the Tribulant Newsletters WordPress plugin before version 4.9.3. User controlled parameters are not escaped in SQL queries and shell commands, so an administrator could run commands on the server. Update to 4.9.3 or later.
What's affected
The NVD record says the Newsletters plugin, before 4.9.3, does not properly escape user controlled parameters when they are appended to SQL queries and shell commands. That could enable an administrator to run arbitrary commands on the server.
WPScan lists the plugin as Newsletter Lite under the slug newsletters-lite and shows Fixed in 4.9.3. Its severity differs from NVD: WPScan gives a CVSS of 6.6 against NVD 7.2. Both place the issue in the medium to high range and both describe an administrator level attacker.
Because the attacker needs an administrator account, the practical risk is highest where many people hold admin rights, where admin passwords are weak or reused, or where an admin account has already been stolen.
How to check if you're exposed
With WP-CLI, read the version.
wp plugin list --format=table
wp plugin get newsletters-lite --fields=name,status,version
Then review who holds administrator rights on each site. Remove accounts that no longer need them and check for unexpected new administrators.
Look at the plugin settings for history and archive options that contain odd values, since the issue involves parameters passed into commands and queries.
What to do now
- Update the Newsletters plugin to 4.9.3 or later on every site.
- Reduce the number of administrator accounts and require multi factor authentication for them.
- Review plugin settings for unexpected values.
- Check the web server account permissions so a compromised plugin cannot write outside the site folder.
- Watch for new processes started by the PHP user on the host.
Why it matters
The record maps this to CWE-77, improper neutralization of special elements in a command. Values from a settings screen are put into a query or a shell command as text, rather than being separated from the command.
Admin only bugs are sometimes dismissed, but on WordPress an administrator can already install plugins, so the added power is limited. The real risks are multi site setups, delegated admin roles and stolen credentials. The record does not claim exploitation and the CVE is not in the CISA KEV catalog. Keep a short list of plugins that run shell commands or write to disk, and review those first when updates ship.
Quick check
If an admin can already install plugins, why patch?
Not every admin should have shell level access, and some hosts restrict plugin installs. Patching closes a path that bypasses those limits.
Sources
Last reviewed: 19 October 2026.
