CVE-2022-0164 - Coming soon and Maintenance mode < 3.6.7 - Subscriber+ Arbitrary Email Sending to Subscribed Users

Back Back to CVE browser

MEDIUM

Coming soon and Maintenance mode < 3.6.7 - Subscriber+ Arbitrary Email Sending to Subscribed Users

Published Feb 21, 2022

4.3

MEDIUM

CVSS 3.1

EPSS 0.35%

Description

The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed users

Affected products

Vendor n/a Product Coming soon and Maintenance mode Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.5.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Coming soon and Maintenance mode

unaffected

Version	Status	Constraints
0	affected	<3.5.3

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-352

CSRF

CWE-862

Missing Authorization

References (2)

https://plugins.trac.wordpress.org/changeset/2655973
patch
https://wpscan.com/vulnerability/942535f9-73bf-4467-872a-20075f03bc51
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://plugins.trac.wordpress.org/changeset/2655973		patch
https://wpscan.com/vulnerability/942535f9-73bf-4467-872a-20075f03bc51		exploitvdb-entrytechnical-descriptionThird Party Advisory