CVE-2023-0766: Newsletter Popup <= 1.2 - Record Deletion via CSRF
The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks as the wpnewslettershowlocalrecord page is not protected with a nonce.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0766?
CVE-2023-0766 has not been officially assigned a severity rating but the lack of CSRF checks poses a significant risk to user security.
How do I fix CVE-2023-0766?
To fix CVE-2023-0766, you should update the Newsletter Popup WordPress plugin to a version beyond 1.2 that includes CSRF protection.
What type of vulnerability is CVE-2023-0766?
CVE-2023-0766 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Newsletter Popup WordPress plugin.
Who is affected by CVE-2023-0766?
CVE-2023-0766 affects users of the Newsletter Popup WordPress plugin versions 1.2 and below.
What actions can attackers perform through CVE-2023-0766?
Attackers can exploit CVE-2023-0766 to make logged in users perform unwanted actions on the wp_newsletter_show_localrecord page.