Cross-Site Request Forgery in Subscribe2 Plugin for WordPress

CVE-2023-3407

Summary

The Subscribe2 plugin for WordPress is susceptible to a Cross-Site Request Forgery vulnerability in versions up to 10.40. This vulnerability stems from missing or inadequate nonce validation when sending test emails. Consequently, an unauthenticated attacker could exploit this weakness to send deceptive test emails containing custom messages to users of affected sites. This is achievable through the manipulation of site administrators into executing actions, such as clicking on malicious links, which triggers the forged requests.

References