PT-2024-15227 · WordPress · Fatal Error Notify

Dmitry Ignatyev · Published 2024-02-27 · Updated 2025-05-01 · CVE-2023-7202

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Fatal Error Notify WordPress plugin versions prior to 1.5.3

Description The issue affects the test error AJAX action in the Fatal Error Notify WordPress plugin, which lacks authorisation and CSRF checks. This allows any authenticated users, such as subscribers, to call the action and spam the admin email address with error messages. The issue is also exploitable via CSRF.

Recommendations For versions prior to 1.5.3, update to version 1.5.3 or later to resolve the issue. As a temporary workaround, consider disabling the test error AJAX action until a patch is available. Restrict access to the admin email address to minimize the risk of spamming.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-7202

Affected Products

Fatal Error Notify

References · 8

• 🔥 https://research.cleantalk.org/cve-2023-7202-fatal-error-notify-error-email-sending-csrf · Exploit
• 🔥 https://wpscan.com/vulnerability/d923ba5b-1c20-40ee-ac69-cd0bb65b375a · Exploit
• https://osv.dev/vulnerability/CVE-2023-7202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7202 · Security Note
• https://twitter.com/CVEnew/status/1762396825955205462 · Twitter Post
• https://t.me/cvenotify/72427 · Telegram Post
• https://t.me/cvenotify/120496 · Telegram Post
• https://t.me/cvenotify/99672 · Telegram Post