Description

WordPress Plugin WP Mass Mail is prone to an open email relay vulnerability that lets attackers send mass emails without authentication. An attacker could exploit this issue to send unsolicited spam email to an unrestricted number of email addresses. WordPress Plugin WP Mass Mail version 2.45 is vulnerable; other versions may also be affected.

Remediation

Disable the plugin until a fix is available

References

http://www.securityfocus.com/bid/53818/exploit

http://packetstormsecurity.com/files/113286/WordPress-WP-Mass-Mail-Spoofing.html

http://1337day.com/exploits/18445

Related Vulnerabilities

ownCloud Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-9042)

WordPress Plugin Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list CSV Injection (2.0.68)

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-1916)

WordPress Plugin WP-Recall-Registration, Profile, Commerce & More Cross-Site Scripting (16.24.47)

Jenkins Protection Mechanism Failure Vulnerability (CVE-2021-21696 )

Severity

High

Classification

CWE-264 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update