Description

WordPress Plugin Email Queue by BestWebSoft is prone to a cross-site request forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application; other attacks are also possible. WordPress Plugin Email Queue by BestWebSoft version 1.0.0 is vulnerable.

Remediation

Update to plugin version 1.0.1 or latest

References

https://packetstormsecurity.com/files/134891/WordPress-Email-Queue-1.0.0-Cross-Site-Request-Forgery.html

https://wordpress.org/plugins/email-queue/changelog/

Related Vulnerabilities

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Multiple Vulnerabilities (1.9.2.2)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-7986)

WordPress Plugin HUSKY-Products Filter Professional for WooCommerce Multiple Vulnerabilities (1.1.9)

WordPress Plugin Virim PHP Object Injection (0.4)

WordPress Plugin WordPress Button Plugin MaxButtons Security Bypass (1.19.0)

Severity

High

Classification

CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update CSRF