CVE-2023-1430
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.3 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
33.2%
The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.7.40 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to unsubscribe users from lists and manage subscriptions, granted they gain access to any targeted subscribers email address.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| wpmanageninja:fluentcrm | wpmanageninja fluentcrm | le | 2.7.40 |
CNA Affected
[
{
"vendor": "techjewel",
"product": "Email Marketing, Newsletter, Email Automation and CRM Plugin for WordPress by FluentCRM",
"versions": [
{
"version": "2.7.40",
"status": "affected"
}
],
"defaultStatus": "unaffected"
}
]References
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.3 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
33.2%