Description

WordPress Plugin WORDPRESS VIDEO GALLERY is prone to an open email relay vulnerability that lets attackers send mass emails without authentication. An attacker could exploit this issue to send unsolicited spam email to an unrestricted number of email addresses. WordPress Plugin WORDPRESS VIDEO GALLERY version 2.8 is vulnerable; other versions may also be affected.

Remediation

Disable the plugin until a fix is available

References

http://www.homelab.it/index.php/2015/05/22/wordpress-video-gallery-2-8-unprotected-mail-page/

https://www.exploit-db.com/exploits/37106/

http://packetstormsecurity.com/files/132015/WordPress-Video-Gallery-2.8-Unprotected-Mail-Page.html

Related Vulnerabilities

WordPress Plugin WPtouch Cross-Site Scripting (3.7.5.3)

MySQL CVE-2022-21318 Vulnerability (CVE-2022-21318)

Squid Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Vulnerability (CVE-2020-15049)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-0009)

Magento Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2020-24406)

Severity

High

Classification

CWE-264 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update