CVE-2023-5672: falha em WP Mail Log
WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpoint
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.7%
The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files.
Produtos afetados
Unknown · WP Mail LogCVEs relacionadas — WP Mail Log
No mesmo produto, das mais perigosas para as menos.
CVE-2023-5674—WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs/send_mail endpointEPSS 10.8%CVE-2023-5673—WP Mail Log < 1.1.3 – Contributor+ Arbitrary File Upload to RCEEPSS 1.1%CVE-2023-5645—WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs endpointEPSS 0.7%CVE-2023-5644HIGHWP Mail Log < 1.1.3 – Incorrect Authorization in REST API EndpointsEPSS 0.5%