CVE-2023-3179

POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF

published July 17, 2023

CVSS
—
EPSS
0%
Percentile
31.9
In the wild
Unconfirmed
What it is

The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00389 · 31.9th percentile
Published
2023-07-17T13:29Z
EPSS history
Timeline
  • 17 JUL 13:29Z
    POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF
    cvelistv5