CVE-2023-5672: WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpoint
Published Dec 26, 2023
·Updated
The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files.
Affected Software
1 affected component
WPVibes Wp Mail Log Wordpress<1.1.3
Event History
Dec 26, 2023
CVE Published
via MITRE·06:33 PM
Data Sourced
via MITRE·06:33 PM
DescriptionWeakness
May 24, 57290
Event
via FIRST·01:25 AM
Frequently Asked Questions
1
What is the severity of CVE-2023-5672?
CVE-2023-5672 is classified as a high severity vulnerability due to its potential for local file inclusion and arbitrary file leakage.
2
How do I fix CVE-2023-5672?
To fix CVE-2023-5672, update the WP Mail Log plugin to version 1.1.3 or later.
3
What versions of WP Mail Log are affected by CVE-2023-5672?
CVE-2023-5672 affects all versions of the WP Mail Log plugin prior to version 1.1.3.
4
Can CVE-2023-5672 lead to data breaches?
Yes, CVE-2023-5672 can lead to data breaches by allowing attackers to access arbitrary files on the server.
5
What type of attack does CVE-2023-5672 enable?
CVE-2023-5672 enables local file inclusion attacks, which can be exploited to read sensitive files.