CVE-2023-3178

POST SMTP Mailer < 2.5.7 - Arbitrary Log Deletion via CSRF

Medium · published January 16, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
17.7
In the wild
Unconfirmed
What it is

The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability delete arbitrary logs via a CSRF attack.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00266 · 17.7th percentile
Published
2024-01-16T15:55Z
EPSS history
Timeline
  • 16 JAN 15:55Z
    POST SMTP Mailer < 2.5.7 - Arbitrary Log Deletion via CSRF
    cvelistv5