CVE-2023-5644 - WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints

Back Back to CVE browser

HIGH

WP Mail Log < 1.1.3 – Incorrect Authorization in REST API Endpoints

Published Dec 26, 2023

7.6

HIGH

CVSS 3.1

EPSS 0.50%

Description

The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.

Affected products

Vendor n/a Product WP Mail Log Default
unaffected
Affected
- ≥ 0, < 1.1.3

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	WP Mail Log	unaffected	Affected ≥ 0, < 1.1.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57937
Advisory
https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-57937		Advisory
https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Dec 26, 2023

Updated Sep 25, 2024

Reserved Oct 18, 2023

Link CVE-2023-5644

CISA Vulnrichment

Updated Sep 25, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-5644

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published Dec 26, 2023

Updated Sep 25, 2024

Link EUVD-2023-57937

GitHub

No data