Unauthenticated Hook Injection Vulnerability in Check & Log Email Plugin for WordPress
CVE-2024-0866

8.1HIGH

Key Information:

Vendor
Wordpress
Status
Check & Log Email
Vendor
CVE Published:
26 March 2024

Summary

The Check & Log Email plugin for WordPress is vulnerable to unauthenticated hook injection, affecting all versions up to and including 1.0.9. This vulnerability arises via the 'check_nonce' function, which allows attackers, without authentication, to execute malicious actions using hooks within the WordPress environment. Successful exploitation requires the attacker to know a nonce value that is used for action execution, coupled with the absence of proper capability validation. As a result, this could lead to unauthorized changes and impact the integrity of WordPress sites implementing this plugin.

Affected Version(s)

Check & Log Email * <= 1.0.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sean Murphy
.