PT-2022-23317 · WordPress · Mailoptin

Muhammad Daffa · Published 2022-09-23 · Updated 2022-09-26 · CVE-2022-36340

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions MailOptin plugin versions 1.2.49.0 and earlier

Description The issue concerns an Unauthenticated Optin Campaign Cache Deletion vulnerability. This vulnerability affects the MailOptin plugin at WordPress, allowing for unauthenticated cache deletion of opt-in campaigns.

Recommendations For MailOptin plugin versions 1.2.49.0 and earlier, update to a version later than 1.2.49.0 to resolve the issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-36340

Affected Products

Mailoptin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-36340 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36340 · Vendor Advisory
• https://t.me/cibsecurity/50368 · Telegram Post
• https://patchstack.com/database/vulnerability/mailoptin/wordpress-mailoptin-plugin-1-2-49-0-unauthenticated-optin-campaign-cache-deletion-vulnerability/_s_id=cve · Note
• https://plugins.svn.wordpress.org/mailoptin/trunk/changelog.txt · Note