CVE-2023-3178

MEDIUM

POST SMTP Mailer WordPress Plugin < 2.5.7 - Cross-Site Request Forgery via Log Deletion AJAX Action

Title source: llm
STIX 2.1

Description

The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability delete arbitrary logs via a CSRF attack.

References (1)

Core 1
Core References
Exploit, Product, Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/5341cb5d-d204-49e1-b013-f8959461995f/

Scores

CVSS v3 4.3
EPSS 0.0023
EPSS Percentile 14.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (1)
wpexperts/post_smtp < 2.5.7
Published Jan 16, 2024
Tracked Since Feb 18, 2026