CVE-2023-3179
Last modified
CVE-2023-3179 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wpexperts | Post Smtp | < 2.5.7 |
References
- https://wpscan.com/vulnerability/542caa40-b199-4397-90bb-4fdb693ebb24Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/542caa40-b199-4397-90bb-4fdb693ebb24Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-3179?
How severe is CVE-2023-3179?
How do I fix CVE-2023-3179?
Are you affected by CVE-2023-3179?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST