PT-2023-31583 · WordPress · Super Store Finder

Etharus · Publicado 2023-09-18 · Atualizado 2023-11-03 · CVE-2023-5054

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Super Store Finder plugin for WordPress versions up to, and including, 6.9.3

Description The issue is related to insufficient restrictions on the sendMail.php file, allowing direct access and enabling unauthenticated attackers to send emails with arbitrary content using the vulnerable site's server. This vulnerability has been publicly disclosed with an exploit available.

Recommendations For versions up to, and including, 6.9.3, as a temporary workaround, consider restricting access to the sendMail.php file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2023-5054

Produtos afetados

Super Store Finder

Referências · 9

• https://twitter.com/vuldb/status/1704073863167197421 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1704025761537982647 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-5054 · Aviso do Fabricante
• https://wordfence.com/threat-intel/vulnerabilities/id/d31d0553-9378-4c7e-a258-12562aa6b388?source=cve · Nota
• https://twitter.com/VulmonFeeds/status/1704086971662946795 · Publicação no Twitter
• https://t.me/cvenotify/58331 · Publicação no Telegram
• https://superstorefinder.net · Nota
• https://superstorefinder.net/support/forums/topic/super-store-finder-for-wordpress-patch-notes · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-5054 · Nota de Segurança