Post SMTP < 2.8.7 - Admin+ SQL Injection
CVE-2023-6620

7.2HIGH

Key Information:

Vendor

Wordpress
Status
Post Smtp Mailer
Vendor
CVE Published:
15 January 2024

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 14%

What is CVE-2023-6620?

The POST SMTP Mailer WordPress plugin exhibits a vulnerability due to inadequate sanitization and escaping of various parameters utilized within SQL statements. This flaw can be exploited by users with elevated privileges, such as those with admin access, potentially allowing them to execute unauthorized SQL queries. Proper measures should be taken to ensure that the plugin is updated to version 2.8.7 or later to mitigate this risk.

Affected Version(s)

POST SMTP Mailer 0 < 2.8.7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-6620 - Proof of Concept

References

https://wpscan.com/vulnerability/ab5c42ca-ee7d-4344-bd88-...
exploitvdb-entrytechnical-description

EPSS Score

14% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Sanford
WPScan
.