PT-2020-10367 · WordPress · Postie

Published 2020-01-01 · Updated 2020-08-24 · CVE-2019-20203

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Postie plugin version 1.9.40

Description The issue allows remote attackers to publish posts by spoofing the From information of an email message, leveraging the Authorized Addresses feature.

Recommendations For Postie plugin version 1.9.40, update to a newer version that contains a fix for this issue.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2019-20203

Affected Products

Postie

References · 6

• 🔥 https://github.com/V1n1v131r4/Exploiting-Postie-WordPress-Plugin-/blob/master/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2019-20203 · Vendor Advisory
• https://wordpress.org/plugins/postie/#developers · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20203 · Security Note
• https://wpvulndb.com/vulnerabilities/10002 · Note
• https://postieplugin.com · Note