9.8
CVSS 3.1
4,5%
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be used to inject new administrative user accounts.
Засегнати продукти
- smub Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more: преди 1.3.9.1
Вид слабост
История
- 7 юни 2023 Публикувано
Други уязвимости в smub Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2019-25141
- https://nvd.nist.gov/vuln/detail/CVE-2019-25141
- https://www.wordfence.com/threat-intel/vulnerabilities/id/84b75f7d-7258-46f6-aee6-b96d70bee264?source=cve
- https://plugins.trac.wordpress.org/changeset?old_path=%2Feasy-wp-smtp&old=2052057&new_path=%2Feasy-wp-smtp&new=2052058&sfp_email=&sfph_mail=
- https://blog.nintechnet.com/critical-0day-vulnerability-fixed-in-wordpress-easy-wp-smtp-plugin/
- https://wordpress.org/support/topic/vulnerability-26/