Unauthorized Post Publishing in Postie Plugin for WordPress

CVE-2019-20203

Summary

The Postie plugin version 1.9.40 for WordPress is susceptible to an authorization bypass vulnerability that enables remote attackers to publish posts without proper authentication. By spoofing the 'From' email address in submitted messages, attackers can manipulate the plugin's Authorized Addresses feature, resulting in unauthorized post creation on target WordPress sites. This flaw highlights the necessity for robust email validation processes to prevent malicious exploit.

References