Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: Wp-email Project Clear all filters
TI-2022-01500 CVE-2022-1630 · GHSA-vg5f-hrqf-wrmv

WP-Email < 2.69.0 - Log Deletion via CSRF

Priority LOW 30

The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a logged in admin delete logs via a CSRF attack

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00534 Published 2022-06-20 Fixed in 2.69.0 CWE-352
TI-2022-01484 CVE-2022-1614 · GHSA-m7mv-qpw5-vp4f

WP-Email < 2.69.0 - Anti-Spam Protection Bypass via IP Spoofing

Priority LOW 35

The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based anti-spamming restrictions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01178 Published 2022-06-20 Fixed in 2.69.0 CWE-639