CVE-2023-3179: POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the managepostmansmtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for the POST SMTP Mailer WordPress plugin?
The vulnerability ID for the POST SMTP Mailer WordPress plugin is CVE-2023-3179.
What is the severity of CVE-2023-3179?
The severity of CVE-2023-3179 is high with a severity value of 8.8.
What software is affected by CVE-2023-3179?
The POST SMTP Mailer WordPress plugin versions up to and exclusive of 2.5.7 are affected by CVE-2023-3179.
What is the CWE ID for CVE-2023-3179?
The CWE ID for CVE-2023-3179 is 352.
Is there a fix available for CVE-2023-3179?
Yes, upgrading to version 2.5.7 of the POST SMTP Mailer WordPress plugin will fix the vulnerability.