CVE-2014-4725

CVE-2014-4725 describes an unauthenticated arbitrary file upload vulnerability in the MailPoet Newsletters plugin (versions prior to 2.6.7) for WordPress. This critical flaw allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a malicious theme file. With a CVSS score of 7.5, the vulnerability is easily exploitable over the network with low attack complexity, potentially leading to full compromise of the affected system. While not on CISA's KEV catalog, a Metasploit module and ExploitDB entry exist, indicating readily available exploit code, despite limited community discussion or media coverage.