CVE-2016-10956 Scanner

The Mail Masta plugin for WordPress is an email marketing solution designed to help users manage email campaigns, create lists, design templates, and automate sending. It is widely used by website owners for its ease of use and cost-effectiveness, making it a popular choice among WordPress users seeking efficient email marketing tools.

CVE-2016-10956 is a Local File Inclusion (LFI) vulnerability that arises from insufficient input validation in the plugin. Attackers can manipulate file path parameters to include arbitrary local files, bypassing intended access controls. This flaw exists because the plugin fails to sanitize user-supplied input before using it in file inclusion functions.

Specifically, the vulnerability is present in the count_of_send.php and csvexport.php files. The vulnerable parameters allow attackers to specify file paths without proper validation, enabling them to include sensitive files like /etc/passwd or wp-config.php. This can be exploited remotely without authentication, making it a critical security issue.

If exploited, an attacker can read sensitive data such as database credentials, server logs, and user information. This could lead to full site compromise, data theft, or further attacks like privilege escalation. The CVSS score of 7.5 highlights the high severity and potential for significant damage to affected WordPress sites.