deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-37767
Published: 2023-07-11
Description: GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the BM_ParseIndexValueReplace function at /lib/libgpac.so.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/gpac/gpac/issues/2514; https://github.com/gpac/gpac/issues/2514
CVE: CVE-2023-30226
Published: 2023-07-12
Description: An issue was discovered in function get_gnu_verneed in rizinorg Rizin prior to 0.5.0 verneed_entry allows attackers to cause a denial of service via crafted elf file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-834
References: https://github.com/ifyGecko/CVE-2023-30226; https://github.com/rizinorg/rizin/commit/a6d89de0d44e776f9bccc3a168fdc79f604e14ed; https://github.com/ifyGecko/CVE-2023-30226
CVE: CVE-2020-36750
Published: 2023-07-12
Description: The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is due to missing or incorrect nonce validation on the ewww_ngg_bulk_init() function. This makes it possible for unauthenticated attackers to perform bulk image optimization via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4407
Published: 2023-07-12
Description: The Custom Banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.2 This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to save custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4408
Published: 2023-07-12
Description: The DW Question & Answer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.8. This is due to missing or incorrect nonce validation on the update_answer() function. This makes it possible for unauthenticated attackers to update answers to questions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4409
Published: 2023-07-12
Description: The WooCommerce Etsy Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the etcpf_delete_feed() function. This makes it possible for unauthenticated attackers to delete an export feed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4410
Published: 2023-07-12
Description: The Qtranslate Slug plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.18. This is due to missing or incorrect nonce validation on the save_postdata() function. This makes it possible for unauthenticated attackers to save post data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4411
Published: 2023-07-12
Description: The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the wpep_download_transaction_in_excel() function. This makes it possible for unauthenticated attackers to trigger a transactions download via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4412
Published: 2023-07-12
Description: The WP Prayer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5. This is due to missing or incorrect nonce validation on the save() and export() functions. This makes it possible for unauthenticated attackers to save plugin settings and trigger a data export via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4413
Published: 2023-07-12
Description: The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to save field icons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4414
Published: 2023-07-12
Description: The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.5. This is due to missing or incorrect nonce validation on the wcal_preview_emails() function. This makes it possible for unauthenticated attackers to generate email preview templates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4415
Published: 2023-07-12
Description: The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshine_products_quicksave_post() function. This makes it possible for unauthenticated attackers to save custom post data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4416
Published: 2023-07-12
Description: The wp-mpdf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.1. This is due to missing or incorrect nonce validation on the mpdf_admin_savepost() function. This makes it possible for unauthenticated attackers to save post data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2021-4417
Published: 2023-07-12
Description: The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.13.4. This is due to missing or incorrect nonce validation on the listen_for_saving_export_schedule() function. This makes it possible for unauthenticated attackers to export form submissions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2020-36752
Published: 2023-07-12
Description: The Coming Soon & Maintenance Mode Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.57. This is due to missing or incorrect nonce validation on the save_meta_box() function. This makes it possible for unauthenticated attackers to save meta boxes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/; https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE: CVE-2023-2517
Published: 2023-07-12
Description: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on the permalink_setup function. This makes it possible for unauthenticated attackers to change the permalink structure via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. While nonce verification is implemented, verification only takes place when a nonce is provided.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/metform/trunk/plugin.php#L544; https://plugins.trac.wordpress.org/changeset/2907471/metform/trunk?contextall=1&old=2896914&old_path=%2Fmetform%2Ftrunk; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2924362%40metform%2Ftrunk&old=2910040%40metform%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2023-2561
Published: 2023-07-12
Description: The Gallery Metabox for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gallery_remove function in versions up to, and including, 1.5. This makes it possible for subscriber-level attackers to modify galleries attached to posts and pages with this plugin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/gallery-metabox/trunk/gallery-metabox.php?rev=611664#L233; https://www.wordfence.com/threat-intel/vulnerabilities/id/faad339f-96d6-4937-a1f3-9d2d19bc6395?source=cve; https://plugins.trac.wordpress.org/browser/gallery-metabox/trunk/gallery-metabox.php?rev=611664#L233
CVE: CVE-2023-2562
Published: 2023-07-12
Description: The Gallery Metabox for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the refresh_metabox function in versions up to, and including, 1.5. This makes it possible for subscriber-level attackers to obtain a list of images attached to a post.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/gallery-metabox/trunk/gallery-metabox.php?rev=611664#L203; https://www.wordfence.com/threat-intel/vulnerabilities/id/951e4651-56d6-474d-84b3-5a7cfc357b9f?source=cve; https://plugins.trac.wordpress.org/browser/gallery-metabox/trunk/gallery-metabox.php?rev=611664#L203
CVE: CVE-2023-2869
Published: 2023-07-12
Description: The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the do_field_reorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorder form elements on login forms.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-members/trunk/includes/admin/tabs/class-wp-members-admin-tab-fields.php?rev=2895180#L799; https://plugins.trac.wordpress.org/changeset/2920897/wp-members/trunk/includes/admin/tabs/class-wp-members-admin-tab-fields.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/bf05a79a-0375-4c9d-bbf0-a87484327b87?source=cve
CVE: CVE-2023-3011
Published: 2023-07-12
Description: The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.5. This is due to missing or incorrect nonce validation on the arm_check_user_cap function. This makes it possible for unauthenticated attackers to perform multiple unauthorized actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/2932691/armember-membership/trunk/autoload.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/42f5f29b-2d83-4b15-82aa-0598f8a2317b?source=cve; https://plugins.trac.wordpress.org/changeset/2932691/armember-membership/trunk/autoload.php
CVE: CVE-2023-3023
Published: 2023-07-12
Description: The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in versions up to, and including, 5.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with administrator-level or above permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/2923668/wp-easycart/trunk/admin/inc/wp_easycart_admin_table.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/c9c1ddaf-4bf2-4937-b7bf-a09162db043e?source=cve; https://plugins.trac.wordpress.org/changeset/2923668/wp-easycart/trunk/admin/inc/wp_easycart_admin_table.php
CVE: CVE-2023-3080
Published: 2023-07-12
Description: The WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2924014/wp-mail-catcher; https://www.wordfence.com/threat-intel/vulnerabilities/id/1525e1c9-4b94-4f9f-92c5-fc69fe000771?source=cve; https://plugins.trac.wordpress.org/changeset/2924014/wp-mail-catcher
CVE: CVE-2023-3081
Published: 2023-07-12
Description: The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: An incomplete fix was released in 1.11.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2923464/wp-mail-logging; https://plugins.trac.wordpress.org/changeset/2925728/wp-mail-logging; https://www.wordfence.com/threat-intel/vulnerabilities/id/ef20b3e6-d8f4-458e-b604-b46ef16e229e?source=cve
CVE: CVE-2023-3082
Published: 2023-07-12
Description: The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2935537/post-smtp; https://www.wordfence.com/threat-intel/vulnerabilities/id/6ecd0fa6-4fdb-4780-9560-0bb126800685?source=cve; https://plugins.trac.wordpress.org/changeset/2935537/post-smtp
CVE: CVE-2023-3087
Published: 2023-07-12
Description: The FluentSMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2935217/fluent-smtp/trunk/app/Models/Logger.php; https://plugins.trac.wordpress.org/changeset/2935217/fluent-smtp/trunk/app/Services/Mailer/BaseHandler.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/fa47a794-e5ce-491d-a10b-c7c5718aa853?source=cve
CVE: CVE-2023-3088
Published: 2023-07-12
Description: The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2931706/wp-mail-log; https://www.wordfence.com/threat-intel/vulnerabilities/id/86ee1acb-6f0c-40e6-80a0-fc93b61c1602?source=cve; https://plugins.trac.wordpress.org/changeset/2931706/wp-mail-log
CVE: CVE-2023-3092
Published: 2023-07-12
Description: The SMTP Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.3.46 due to insufficient input sanitization and output escaping when the 'Save Data SendMail' feature is enabled. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/smtp-mail/tags/1.3.42/includes/data-list-table.php; https://plugins.trac.wordpress.org/browser/smtp-mail/tags/1.3.43/includes/data-list-table.php; https://plugins.trac.wordpress.org/browser/smtp-mail/trunk/includes/data-list-table.php
CVE: CVE-2023-3093
Published: 2023-07-12
Description: The YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2922163/; https://www.wordfence.com/threat-intel/vulnerabilities/id/68e6ec3a-c5fd-4f63-a9a0-2c9ddfb96e2e?source=cve; https://plugins.trac.wordpress.org/changeset/2922163/
CVE: CVE-2023-3105
Published: 2023-07-12
Description: The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for attackers with with existing account access at any level, to change user passwords and potentially take over administrator accounts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://www.learndash.com/release-notes/; https://www.wordfence.com/threat-intel/vulnerabilities/id/2318b3e1-268d-45fa-83bf-c6e88f1b9013?source=cve; https://www.learndash.com/release-notes/
CVE: CVE-2023-3122
Published: 2023-07-12
Description: The GD Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 3.9.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/2923988/gd-mail-queue; https://www.wordfence.com/threat-intel/vulnerabilities/id/0b668f45-c7fb-481b-bc8e-115e5b7248c9?source=cve; https://plugins.trac.wordpress.org/changeset/2923988/gd-mail-queue
CVE: CVE-2023-3135
Published: 2023-07-12
Description: The Mailtree Log Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2928716/mailtree-log-mail; https://www.wordfence.com/threat-intel/vulnerabilities/id/24d0229c-0f1b-42df-b89a-ce0b8a3fda7e?source=cve; https://plugins.trac.wordpress.org/changeset/2928716/mailtree-log-mail
CVE: CVE-2023-3158
Published: 2023-07-12
Description: The Mail Control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 0.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/mail-control/trunk/includes/admin.php#L42; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2943913%40mail-control&new=2943913%40mail-control&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/77537eb8-1c84-4702-aba1-727b0de1c3e1?source=cve