CVE-2023-5054

The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This is due to insufficient restrictions on the sendMail.php file that allows direct access. This makes it possible for unauthenticated attackers to send emails utilizing the vulnerable site's server, with arbitrary content. Please note that this vulnerability has already been publicly disclosed with an exploit which is why we are publishing the details without a patch available, we are attempting to initiate contact with the developer.

• CWE-862

• https://superstorefinder.net/Product
• https://superstorefinder.net/support/forums/topic/super-store-finder-for-wordpress-patch-notes/Release Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d31d0553-9378-4c7e-a258-12562aa6b388?source=cveThird Party Advisory
• https://superstorefinder.net/Product
• https://superstorefinder.net/support/forums/topic/super-store-finder-for-wordpress-patch-notes/Release Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d31d0553-9378-4c7e-a258-12562aa6b388?source=cveThird Party Advisory

Published

Sep 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-5049The Giveaways and Contests by RafflePress plugin for WordPre…5.4
• CVE-2023-50495NCurse v6.4-20230418 was discovered to contain a segmentatio…6.5
• CVE-2023-5050The Leaflet Map plugin for WordPress is vulnerable to Stored…5.4
• CVE-2023-5051The CallRail Phone Call Tracking plugin for WordPress is vul…5.4
• CVE-2023-5052vulnerability in Uniform Server Zero, version 10.2.5, consis…6.3
• CVE-2023-5053Hospital management system version 378c157 allows to bypass …9.8
• CVE-2023-5055Possible variant of CVE-2021-3434 in function le_ecred_recon…9.8
• CVE-2023-50550layui up to v2.74 was discovered to contain a cross-site scr…5.4
• CVE-2023-50559An issue was discovered in XiangShan v2.1, allows local atta…5.5
• CVE-2023-5056A flaw was found in the Skupper operator, which may permit a…4.1
• CVE-2023-50563Semcms v4.8 was discovered to contain a SQL injection vulner…9.8
• CVE-2023-50564An arbitrary file upload vulnerability in the component /inc…8.8