PT-2024-37803 · WordPress · Wp Mail Smtp

Guus Verbeek · Published 2024-07-20 · Updated 2024-07-22 · CVE-2024-6694

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Mail SMTP plugin for WordPress versions up to, and including, 4.0.1

Description The issue allows authenticated attackers with administrative-level access and above to view the SMTP password for the supplied server when viewing the settings, as the plugin provides the SMTP password in the SMTP Password field. This could be useful information to an attacker in a limited environment if an administrator account becomes compromised.

Recommendations For WP Mail SMTP plugin for WordPress versions up to, and including, 4.0.1, consider restricting access to the SMTP settings page to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit administrative-level access to trusted users only.

Fix

Weakness Enumeration

CWE-257

Related Identifiers

CVE-2024-6694

Affected Products

Wp Mail Smtp

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-6694 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2d4e9daf-d414-4ace-9efd-4c3e16deeb8f?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3120454/wp-mail-smtp/trunk/src/Providers/OptionsAbstract.php · Note
• https://t.me/cvenotify/86830 · Telegram Post
• https://t.me/cvedetector/1242 · Telegram Post