CVE-2023-5674: falha em WP Mail Log
WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs/send_mail endpoint
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 11%
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
Produtos afetados
Unknown · WP Mail LogCVEs relacionadas — WP Mail Log
No mesmo produto, das mais perigosas para as menos.
CVE-2023-5673—WP Mail Log < 1.1.3 – Contributor+ Arbitrary File Upload to RCEEPSS 1.1%CVE-2023-5645—WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs endpointEPSS 0.7%CVE-2023-5672—WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpointEPSS 0.7%CVE-2023-5644HIGHWP Mail Log < 1.1.3 – Incorrect Authorization in REST API EndpointsEPSS 0.5%