Read the docs

Wp-email Project

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Wp-email Project records in CISA KEV

No Wp-email Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wp-email 2 records LOW

Records

2 records in Wp-email · all components

TI-2022-01484 CVE-2022-1614 · GHSA-m7mv-qpw5-vp4f

WP-Email < 2.69.0 - Anti-Spam Protection Bypass via IP Spoofing

Priority LOW 35

The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based anti-spamming restrictions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01178 Published 2022-06-20 Fixed in 2.69.0 CWE-639
TI-2022-01500 CVE-2022-1630 · GHSA-vg5f-hrqf-wrmv

WP-Email < 2.69.0 - Log Deletion via CSRF

Priority LOW 30

The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a logged in admin delete logs via a CSRF attack

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00534 Published 2022-06-20 Fixed in 2.69.0 CWE-352
Open these records in search →