Description

WordPress Plugin WP Mass Mail is prone to an open email relay vulnerability that lets attackers send mass emails without authentication. An attacker could exploit this issue to send unsolicited spam email to an unrestricted number of email addresses. WordPress Plugin WP Mass Mail version 2.45 is vulnerable; other versions may also be affected.

Remediation

Disable the plugin until a fix is available

References

http://www.securityfocus.com/bid/53818/exploit

http://packetstormsecurity.com/files/113286/WordPress-WP-Mass-Mail-Spoofing.html

http://1337day.com/exploits/18445

Related Vulnerabilities

WordPress Plugin Gallery-Video Gallery and Youtube Gallery Multiple Vulnerabilities (2.0.3)

Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-7827)

TYPO3 Improper Input Validation Vulnerability (CVE-2020-15099)

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2015-2035)

WordPress Plugin 3D Banner Rotator 'upload.php' Arbitrary File Upload (2.1)

Severity

High

Classification

CWE-264 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update