Skip to content
Fencer Vulns
high 7.2

CVE-2018-1002000 json

There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privil…

published 2018-12-03 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-2071

cvss
7.2
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.4%
EPSS 4.4% chance of exploitation in 30 days, percentile 91%
public exploits
1
Exploit-DB

Summary

There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit. There is an exploitable blind SQL injection vulnerability via the del_ids variable by POST request.

Timeline

  1. First public exploit (EDB-45434)
  2. Published

Exploit prediction

4.35% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-45434 WordPress Plugin Arigato Autoresponder and Newsletter 2.5 - Blind SQL Injection / Reflected Cross-Site Scripting webapps, 2018-09-18
  • vapidlabs.com http://www.vapidlabs.com/advisory.php?v=203 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

  • Kiboko Labs https://calendarscripts.info/ Arigato Autoresponder and Newsletter

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.