CVE-2023-5644

Published Dec 26, 2023

Last updated 2 months ago

Overview

Description: The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.
Source: contact@wpscan.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.6
Impact score: 4.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-863

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:wpvibes:wp_mail_log:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0DB6599D-1AF5-4662-B350-8389E2D4988E",
            "versionEndExcluding": "1.1.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References