The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file (such as #############_debug_log.txt) that contains all password-reset links. The attacker can request a reset of the Administrator password and then use a link found there.
References
| Link | Resource |
|---|---|
| https://blog.nintechnet.com/wordpress-easy-wp-smtp-plugin-fixed-zero-day-vulnerability/ | Exploit Third Party Advisory |
| https://wordpress.org/plugins/easy-wp-smtp/#developers | Product Release Notes Third Party Advisory |
| https://blog.nintechnet.com/wordpress-easy-wp-smtp-plugin-fixed-zero-day-vulnerability/ | Exploit Third Party Advisory |
| https://wordpress.org/plugins/easy-wp-smtp/#developers | Product Release Notes Third Party Advisory |
Configurations
History
21 Nov 2024, 05:27
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://blog.nintechnet.com/wordpress-easy-wp-smtp-plugin-fixed-zero-day-vulnerability/ - Exploit, Third Party Advisory | |
| References | () https://wordpress.org/plugins/easy-wp-smtp/#developers - Product, Release Notes, Third Party Advisory |
Information
Published : 2020-12-14 03:15
Updated : 2024-11-21 05:27
NVD link : CVE-2020-35234
Mitre link : CVE-2020-35234
CVE.ORG link : CVE-2020-35234
JSON object : View
Products Affected
wp-ecommerce
- easy_wp_smtp
CWE
CWE-532
Insertion of Sensitive Information into Log File