Lucene search

K
cve[email protected]CVE-2023-5054
HistorySep 19, 2023 - 7:15 a.m.

CVE-2023-5054

2023-09-1907:15:51
web.nvd.nist.gov
23
super store finder
wordpress
vulnerability
unauthenticated
arbitrary email creation
relay
nvd
cve-2023-5054

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

28.9%

The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This is due to insufficient restrictions on the sendMail.php file that allows direct access. This makes it possible for unauthenticated attackers to send emails utilizing the vulnerable site’s server, with arbitrary content. Please note that this vulnerability has already been publicly disclosed with an exploit which is why we are publishing the details without a patch available, we are attempting to initiate contact with the developer.

Affected configurations

Vulners
NVD
Node
super_store_findersuper_store_finderRange6.9.3
VendorProductVersionCPE
superstorefindersuper_store_findercpe:/a:superstorefinder:super_store_finder::::

CNA Affected

[
  {
    "vendor": "Super Store Finder",
    "product": "Super Store Finder",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "6.9.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

28.9%

Related for CVE-2023-5054