CVE-2023-3407

The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to missing or incorrect nonce validation when sending test emails. This makes it possible for unauthenticated attackers to send test emails with custom content to users on sites running a vulnerable version of this plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/subscribe2/trunk/admin/send-email.php#L12Patch
• https://plugins.trac.wordpress.org/changeset/2930676Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/92b4d800-2895-4f7b-8b3b-ee6df75a7908?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/subscribe2/trunk/admin/send-email.php#L12Patch
• https://plugins.trac.wordpress.org/changeset/2930676Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/92b4d800-2895-4f7b-8b3b-ee6df75a7908?source=cveThird Party Advisory

Published

Jun 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3406Path Traversal issue in M-Files Classic Web versions below 2…6.5
• CVE-2023-34060VMware Cloud Director Appliance contains an authentication b…9.8
• CVE-2023-34061Cloud Foundry routing release versions from v0.163.0 to v0.2…7.5
• CVE-2023-34062In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13…7.5
• CVE-2023-34063Aria Automation contains a Missing Access Control vulnerabil…8.3
• CVE-2023-34064Workspace ONE Launcher contains a Privilege Escalation Vulne…4.6
• CVE-2023-3408The Bricks theme for WordPress is vulnerable to Cross-Site R…4.3
• CVE-2023-34085When an AWS DynamoDB table is used for user attribute storag…4.3
• CVE-2023-34086Improper input validation in some Intel(R) NUC BIOS firmware…6.7
• CVE-2023-34087An improper array index validation vulnerability exists in t…7.8
• CVE-2023-34088Collabora Online is a collaborative online office suite. A s…5.4
• CVE-2023-34089Decidim is a participatory democracy framework, written in R…6.1