CVE-2023-3178: POST SMTP Mailer < 2.5.7 - Arbitrary Log Deletion via CSRF
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the managepostmansmtp capability delete arbitrary logs via a CSRF attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3178?
The CVE-2023-3178 vulnerability has a moderate severity level due to the risk of CSRF attacks allowing unauthorized log deletion.
How do I fix CVE-2023-3178?
To fix CVE-2023-3178, update the Post SMTP Mailer WordPress plugin to version 2.5.7 or later.
Who is affected by CVE-2023-3178?
CVE-2023-3178 affects users of the Post SMTP Mailer WordPress plugin versions prior to 2.5.7.
What kind of attack is possible with CVE-2023-3178?
CVE-2023-3178 allows attackers to execute a CSRF attack, potentially enabling logged-in users to delete arbitrary logs.
What capabilities must a user have to be affected by CVE-2023-3178?
Users need to have the manage_postman_smtp capability to be affected by CVE-2023-3178.