PT-2023-31583 · WordPress · Super Store Finder

Etharus · Published 2023-09-18 · Updated 2023-11-03 · CVE-2023-5054

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Super Store Finder plugin for WordPress versions up to, and including, 6.9.3

Description The issue is related to insufficient restrictions on the sendMail.php file, allowing direct access and enabling unauthenticated attackers to send emails with arbitrary content using the vulnerable site's server. This vulnerability has been publicly disclosed with an exploit available.

Recommendations For versions up to, and including, 6.9.3, as a temporary workaround, consider restricting access to the sendMail.php file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-5054

Affected Products

Super Store Finder

References · 9

• https://osv.dev/vulnerability/CVE-2023-5054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5054 · Security Note
• https://twitter.com/vuldb/status/1704073863167197421 · Twitter Post
• https://twitter.com/CVEnew/status/1704025761537982647 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d31d0553-9378-4c7e-a258-12562aa6b388?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1704086971662946795 · Twitter Post
• https://t.me/cvenotify/58331 · Telegram Post
• https://superstorefinder.net · Note
• https://superstorefinder.net/support/forums/topic/super-store-finder-for-wordpress-patch-notes · Note