What is CVE-2023-1844?

CVE-2023-1844 is a vulnerability in the Subscribe2 plugin for WordPress that allows unauthorized access to email functionality, enabling author-level attackers to send emails with arbitrary content and attachments.

How severe is CVE-2023-1844?

CVE-2023-1844 has a severity rating of 4.3 (medium).

What software versions are affected by CVE-2023-1844?

Versions up to and including 10.40 of the Subscribe2 plugin for WordPress are affected by CVE-2023-1844.

How can I fix CVE-2023-1844?

To fix CVE-2023-1844, update the Subscribe2 plugin for WordPress to a version above 10.40.

Where can I find more information about CVE-2023-1844?

More information about CVE-2023-1844 can be found at the following references: [Link 1](https://plugins.trac.wordpress.org/browser/subscribe2/trunk/admin/send-email.php#L12), [Link 2](https://plugins.trac.wordpress.org/changeset/2930676), [Link 3](https://www.wordfence.com/threat-intel/vulnerabilities/id/c34ce601-5cf9-433f-bc9d-5c705eba6b08?source=cve).

Vulnerability/
CVE-2023-1844

medium

4.3

CWE

862

28/6/2023

5/7/2023

CVE-2023-1844

First published: Wed Jun 28 2023(Updated: )

The Subscribe2 plugin for WordPress is vulnerable to unauthorized access to email functionality due to a missing capability check when sending test emails in versions up to, and including, 10.40. This makes it possible for author-level attackers to send emails with arbitrary content and attachments to site users.

Credit: security@wordfence.com

Affected Software	Affected Version	How to fix
Subscribe2 Project Subscribe2	<=10.40

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2023-1844?
CVE-2023-1844 is a vulnerability in the Subscribe2 plugin for WordPress that allows unauthorized access to email functionality, enabling author-level attackers to send emails with arbitrary content and attachments.
How severe is CVE-2023-1844?
CVE-2023-1844 has a severity rating of 4.3 (medium).
What software versions are affected by CVE-2023-1844?
Versions up to and including 10.40 of the Subscribe2 plugin for WordPress are affected by CVE-2023-1844.
How can I fix CVE-2023-1844?
To fix CVE-2023-1844, update the Subscribe2 plugin for WordPress to a version above 10.40.
Where can I find more information about CVE-2023-1844?
More information about CVE-2023-1844 can be found at the following references: [Link 1](https://plugins.trac.wordpress.org/browser/subscribe2/trunk/admin/send-email.php#L12), [Link 2](https://plugins.trac.wordpress.org/changeset/2930676), [Link 3](https://www.wordfence.com/threat-intel/vulnerabilities/id/c34ce601-5cf9-433f-bc9d-5c705eba6b08?source=cve).

collector/nvd-index
agent/weakness
agent/severity
agent/references
agent/author
agent/tags
agent/type
agent/event
agent/remedy
agent/last-modified-date
agent/softwarecombine
agent/first-publish-date
vendor/subscribe2 project
canonical/subscribe2 project subscribe2
version/subscribe2 project subscribe2/10.40

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.