CVE-2022-2369: YaySMTP < 2.2.1 - Subscriber+ Logs Disclosure
Published Aug 1, 2022
·Updated
The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs of the plugin
Affected Software
1 affected component
Yaycommerce Yaysmtp Wordpress<2.2.1
Event History
Aug 1, 2022
CVE Published
via MITRE·12:52 PM
Data Sourced
via MITRE·12:52 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-2369?
CVE-2022-2369 is considered a medium severity vulnerability due to its potential to expose sensitive plugin logs.
2
How do I fix CVE-2022-2369?
To fix CVE-2022-2369, update the YaySMTP plugin to version 2.2.1 or later.
3
Who is affected by CVE-2022-2369?
CVE-2022-2369 affects all versions of the YaySMTP WordPress plugin prior to 2.2.1.
4
What is the impact of CVE-2022-2369?
The impact of CVE-2022-2369 is that any logged-in user can access and view the plugin logs without proper authorization.
5
What versions are vulnerable for CVE-2022-2369?
CVE-2022-2369 affects all versions of the YaySMTP plugin below version 2.2.1.