Critical severity · published Jun 7, 2023
CVE-2019-25141
Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update
9.8
CVSS
4.5%
EPSS
No
On KEV
Description
The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be used to inject new administrative user accounts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.5% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EW
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more · smub
before 1.3.9.1 · source: vendor
EW
Easy WP Smtp · Wp-ecommerce
through 1.3.9 · source: NVD
Affected product
EW
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more
smub
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-25141
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-25141
Exploit
https://blog.nintechnet.com/critical-0day-vulnerability-fixed-in-wordpress-easy-wp-smtp-plugin/
Patch
https://plugins.trac.wordpress.org/changeset?old_path=%2Feasy-wp-smtp&old=2052057&new_path=%2Feasy-wp-smtp&new=2052058&sfp_email=&sfph_mail=
Exploit
https://wordpress.org/support/topic/vulnerability-26/
Broken Link
https://www.wordfence.com/threat-intel/vulnerabilities/id/84b75f7d-7258-46f6-aee6-b96d70bee264?source=cve
More from Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more
2.7
CVE-2024-3073
Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UI